So the problem is in lib/libalpm/add.c , here :
/* we'll need to save some record for backup checks later */
oldpkg = _alpm_pkg_dup(local);

We duplicate the package, but we don't make sure that oldpkg->files was filled.
Then the database entry is removed.

Later, when we do this call : hash_orig = _alpm_needbackup(entryname, alpm_pkg_get_backup(oldpkg));
get_backup tries to access to oldpkg->files. If it is empty, it tries to load it from /var/lib/pacman/local/$package/files , which does not exist anymore. So it breaks here.

This only happens when --force is used, because otherwise, we do file conflicts check :
/* Check for file conflicts */
if(!(trans->flags & PM_TRANS_FLAG_FORCE)) {

So in this case, oldpkg->files is filled.

Should we just add an else block to this if statement along these lines?

} else {
/* even if we are forcing install, we need the oldpkg filelist loaded for backup handling later */
alpm_pkg_get_files(oldpkg);
}

Indeed, we can do something like that, though I would prefer it doing it at the place where we create oldpkg, so just after
oldpkg = _alpm_pkg_dup(local);

But another problem is that this package is returned to the frontend :
EVENT(trans, PM_TRANS_EVT_UPGRADE_DONE, newpkg, oldpkg);

So then we have no control over what the frontend could do with it. A frontend has the right to access any fields of a package.
So maybe it would be better to just do :
oldpkg = _alpm_pkg_dup(local);
_alpm_db_read(oldpkg->origin_data.db, oldpkg, INFRQ_FULL);