Originally reported by Luke Stuart here:
http://redmine.alpinelinux.org/issues/436

Essentially what happens is:
- You execute "crontab -e" (as root, for instance)
- Make changes or not: Once the editor is closed, the file /etc/crontabs/cron.update is created with the content "root" (because we edited the root crontab).
- Once crond spots the cron.update file, crond will read through it and see that /etc/crontabs/root essentially needs to be re-read and updated internally.  In the process, crond will remove the cron.update file.

What's happens next:
- /etc/crontabs/root gets moved to /var/spool/cron/cron.root.PID

Result:
Next time crond re-/starts, you have no root crontab!

The trigger:
Simply having the cron.update file; for instance:
# echo "root" > /etc/crontabs/cron.update


To see what's going on, I edited busybox-1.17.3/miscutils/crond.c:
Sample code from ForkJob() - 7 parameters:

816:		rename(mail_filename, mailFile2); // TODO: xrename?
817: +		crondlog(LVL8 "RENAME: mail_filename=%s (old) -> mailFile2=%s (new)", mail_filename, mailFile2);
819:	}


Now, I see the following log messages:

Nov  6 22:03:28 alpine-dev user.info crond[10166]: crond: crond (busybox 1.17.3) started, log level 8
Nov  6 22:15:01 alpine-dev user.info crond[10166]: crond: RENAME: mail_filename=root (old) -> mailFile2=/var/spool/cron/cron.root.10253 (new)
Nov  6 22:15:01 alpine-dev user.info crond[10166]: crond: USER root pid 10253 cmd run-parts /etc/periodic/15min
Nov  6 22:30:01 alpine-dev user.info crond[10166]: crond: RENAME: mail_filename=/var/spool/cron/cron.root.10253 (old) -> mailFile2=/var/spool/cron/cron.root.10283 (new)
Nov  6 22:30:01 alpine-dev user.info crond[10166]: crond: USER root pid 10283 cmd run-parts /etc/periodic/15min
Nov  6 22:45:01 alpine-dev user.info crond[10166]: crond: RENAME: mail_filename=/var/spool/cron/cron.root.10283 (old) -> mailFile2=/var/spool/cron/cron.root.10287 (new)
Nov  6 22:45:01 alpine-dev user.info crond[10166]: crond: USER root pid 10287 cmd run-parts /etc/periodic/15min


Which I don't really understand the first rename from "root" to "cron.root.10253," because line 853 (crond.c) is:
ForkJob(user, line, mailFd, DEFAULT_SHELL, "-c", line->cl_Shell, mailFile);

Where mailFile is set on line 839 like so:
snprintf(mailFile, sizeof(mailFile), "%s/cron.%s.%d", TMPDIR, user, getpid());

How "%s/cron.%s.%d" becomes "root" is beyond me... but maybe I'm missing something.