Why does it work setting the prefix after the validator and not before?
setPrefix() calls HexSpinBox::validate(). In the return statement validate is an uninitialized pointer which causes a segfault.

2) ... Am I guessing wrong?
Run your code in a debugger or put in some qDebug() statements to see what's happening.