Cool, thanks for the extra information. I was able to reproduce this with a release build of Rhino. That gave me some information, but since it was not that much more helpful I tried also with a debug build. Unfortunately it has been as of yet impossible to properly reproduce that same crash. I keep trying though.
Again, @encephalon and @milezee, thanks for reporting and sharing info. I hope we can together get to the bottom of this.