Steps to reproduce:

1) Download attached 'CrashSwitchingMSAA.zip' project and open in Unity
2) Open 'MsaaTest' script and decrease time on 11th line : from 3 change it to 0.2f
3) Make sure VR SDK is set to Daydream in the Player Settings
4) Build and Run 'scene' scene on a device
5) Leave mobile device in idle for ~5 - 10 mins and application will crash

Expected result: Application should not crash
Actual result: Application crash when switching between MSAA levels

Device under test:
Google Pixel, OS:7.1.2, CPU:arm64-v8a, GPU:Adreno (TM) 530, Build:google/sailfish/sailfish:7.1.2/NJH47D/4045516:user/release-keys

Reproduced with:
5.6.3p2, 2017.1.1f1, 2017.2.0b9, 2017.3.0a6

Note: I wasn't able to reproduce this crash if VR SDK was Cardboard using Samsung SM G930F, OS:7.0, CPU:arm64-v8a, GPU:Mali-T880, Build:samsung/heroltexx/herolte:7.0/NRD90M/G930FXXU1ZPK3:user/release-keys

Fatal signal 11 (SIGSEGV), code 1, fault addr 0x190 in tid 10215 (GLThread 158)
08-29 11:46:03.879 563 563 W : debuggerd: handling request: pid=10148 uid=10400 gid=10400 tid=10215
08-29 11:46:03.962 10330 10330 F DEBUG : * * * * * * * * * * * * * * * *
08-29 11:46:03.962 10330 10330 F DEBUG : Build fingerprint: 'google/sailfish/sailfish:7.1.2/NJH47F/4146041:user/release-keys'
08-29 11:46:03.962 10330 10330 F DEBUG : Revision: '0'
08-29 11:46:03.962 10330 10330 F DEBUG : ABI: 'arm'
08-29 11:46:03.962 10330 10330 F DEBUG : pid: 10148, tid: 10215, name: GLThread 158 >>> com.google.test.msaa_2017 <<<
08-29 11:46:03.962 10330 10330 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x190
08-29 11:46:03.962 10330 10330 F DEBUG : r0 c7214f90 r1 356dff12 r2 356dff12 r3 00000001
08-29 11:46:03.962 10330 10330 F DEBUG : r4 00000000 r5 c9ff9cec r6 c9ff9b40 r7 c9ff9dd8
08-29 11:46:03.962 10330 10330 F DEBUG : r8 c9ff9bc0 r9 00000000 sl cc07d400 fp cb916320
08-29 11:46:03.962 10330 10330 F DEBUG : ip ec408948 sp c9ff9b40 lr cacc6413 pc cacc6470 cpsr 60070030
08-29 11:46:03.965 10330 10330 F DEBUG :
08-29 11:46:03.965 10330 10330 F DEBUG : backtrace:
08-29 11:46:03.965 10330 10330 F DEBUG : #00 pc 00230470 /data/app/com.google.vr.vrcore-2/lib/arm/libvrcore_native.so
08-29 11:46:03.966 10330 10330 F DEBUG : #01 pc 0022c40b /data/app/com.google.vr.vrcore-2/lib/arm/libvrcore_native.so
08-29 11:46:03.966 10330 10330 F DEBUG : #02 pc 0022cbc5 /data/app/com.google.vr.vrcore-2/lib/arm/libvrcore_native.so
08-29 11:46:03.966 10330 10330 F DEBUG : #03 pc 0022cd1f /data/app/com.google.vr.vrcore-2/lib/arm/libvrcore_native.so
08-29 11:46:03.966 10330 10330 F DEBUG : #04 pc 001f4271 /data/app/com.google.vr.vrcore-2/lib/arm/libvrcore_native.so
08-29 11:46:03.966 10330 10330 F DEBUG : #05 pc 001f48a7 /data/app/com.google.vr.vrcore-2/lib/arm/libvrcore_native.so
08-29 11:46:03.966 10330 10330 F DEBUG : #06 pc 001f5613 /data/app/com.google.vr.vrcore-2/lib/arm/libvrcore_native.so
08-29 11:46:03.966 10330 10330 F DEBUG : #07 pc 001dd7f1 /data/app/com.google.vr.vrcore-2/lib/arm/libvrcore_native.so
08-29 11:46:03.966 10330 10330 F DEBUG : #08 pc 00194e6b /data/app/com.google.vr.vrcore-2/lib/arm/libvrcore_native.so (Java_com_google_vr_ndk_base_GvrApi_nativeRenderReprojectionThread+14)
08-29 11:46:03.966 10330 10330 F DEBUG : #09 pc 006bbb91 /data/app/com.google.vr.vrcore-2/oat/arm/base.odex (offset 0x45e000)