I finally put together a test case:

Details on how to reproduce the crash are in the annotations for the first paste.

Jonathon McKitrick