I did set up and modify Bugzilla for a previous eCommerce Web site project. Yes, it is free and it does provide decent "out-of-the-box" functionality. But it is one big Perl hack. All the underlying Perl code is written using cryptic single-letter variable-names and there are very few comments in the code. It was a headache to make a minor change such as adding a "BUILD" field. I would recommend Bugzilla to someone only if they are very comfortable with Perl, CGI, UNIX and SQL.
Having said this, I might consider using Bugzilla again, but only after I had a chance to resolve was how it could track multiple code-streams of a single product. Bugzilla has support for bug dependency-tree graphing but we never had a chance to get this working within our company's firewall so I don't know whether this would do the trick.
and, that was the first time I had used the underlying database, mySQL. It seems fairly robust, but I never had a chance to see how it would handle lots of bugs in the system.
We've just adopted the bugzilla method over lotus notes, which served as a repository but did not allow tracking and assignment of bugs the way bugzilla does - I recommend bugzilla in an environment with the code support mentioned by a previous post as well, as the features are numerous but need to be modified by a pro.