How to reproduce:
1. Open the attached “IN-91192.zip” project
2. Open “Assets/InputSys/InputSystem.inputactions”
3. In the “UI” Action Map, add a new Binding for the “Back” action
4. Assign any path to the newly created binding (“Button East [Gamepad]” used in testing)
5. Observe the crash

Reproducible in: 1.9.0 (6000.0.18f1), 1.11.2 (2022.3.55f1, 6000.0.33f1, 6000.1.0a10)
Could not test with: 1.11.2 (2021.3.47f1) - Console errors, see note

Reproducible on: Windows 10 (by user), Windows 11
Not reproducible on: No other environments tested

First few lines of stacktrace:

{noformat}0x00007ff7e2e2b59c (Unity) SerializedProperty::SetStringValue
0x00007ff7e139e26f (Unity) SerializedProperty_CUSTOM_SetStringValueInternal
0x0000013817fd296c (Mono JIT Code) (wrapper managed-to-native) UnityEditor.SerializedProperty:SetStringValueInternal (UnityEditor.SerializedProperty,string)
0x0000013817fd27eb (Mono JIT Code) UnityEditor.SerializedProperty:set_stringValue (string)
0x000001381c652d83 (Mono JIT Code) UnityEngine.InputSystem.Editor.InputControlPathEditor/<>c__DisplayClass7_0:<ShowDropdown>b__1 (string) (at ./Library/PackageCache/com.unity.inputsystem@1.11.2/InputSystem/Editor/ControlPicker/InputControlPathEditor.cs:183){noformat}

Notes:
- In 2021.3.47f1, a “SerializedObject target has been destroyed” error is thrown and no crash occurs when setting the binding path, however, it is unclear if this indicates that the issue is not reproducible or if it is caused by another broken part of the project after downgrading
- It is important that the binding is newly created. Setting the path for an old binding will not cause the crash