We present a memory-based denial-of-service (DoS) attack that exploits Tor's flow control algorithm to remotely kill a Tor relay's process. We show how the attack may be used to deanonymize hidden services while presenting defenses that provably render the attack ineffective and protect hidden services against DoS attacks in general.