How to reproduce:
1. Open the attached “IN-126918” project
2. Open the “CabScene”
3. Open the “DemoUIHandler.cs” script in Visual Studio (Assets > UI > Demo)
4. Change the value of the integer in line 56 and save the file
5. Close Visual Studio
6. Enter Play mode

Reproducible with: 6000.2.8f1
Not reproducible with: 6000.0.66f2, 6000.2.15f1, 6000.3.6f1, 6000.4.0b6, 6000.5.0a5 (don’t know if these versions are affected as reproduction is extremely inconsistent even on the reproducible version)

Reproduced on: Windows 11
Not reproduced on: No other environment tested

Note: Was only able to reproduce the issue once or twice on 6000.2.8f1

First few lines of the obtained stack trace:
0x00007FFD267DE68D (Unity) memcpy
0x00007FFD23CD760A (Unity) TransferField_NonArray<StreamedBinaryWrite,Converter_SimpleNativeClass<AnimationCurveTpl<float> > >
0x00007FFD23CFB079 (Unity) Transfer_SimpleNativeClass<StreamedBinaryWrite,AnimationCurveTpl<float>,0>
0x00007FFD23C508C5 (Unity) ExecuteSerializationCommands<ConfigSettingsRead>

Users stack trace:
0x00007FFE5EA22853 (Unity) tlsf_free
0x00007FFE5C51D9DF (Unity) DynamicHeapAllocator::Deallocate
0x00007FFE5C517D12 (Unity) DualThreadAllocator<DynamicHeapAllocator>::TryDeallocate
0x00007FFE5C5276AF (Unity) MemoryManager::TryDeallocateWithLabel