Steps to reproduce:
1. Open the attached user's project "3158787_6.3.13.zip"
2. From the top menu bar, select "Repro > Stress > Run Full Battery"

Actual Result: Editor crashes
Expected Result: Editor does not crash

Reproducible with: 6000.3.16f1, 6000.4.0a2 (417aa67423b3), 6000.4.8f1, 6000.5.0b9, 6000.6.0a5
Not reproducible with: 6000.0.75f1, 6000.4.0a1 (b27b8eafe426)

Testing Environment: Windows 11
Not reproducible on: no other environment tested

Notes:
-This crash can also be reproduced infrequently manually by opening the console, generating 500 messages, hovering over an element in the array (to bring up the tooltip with the link) and then moving the mouse around randomly for some time (a minute or so)
-"Run Full Battery" opens the window, emits 200 Debug.LogWarning messages containing chained <color><link><u>…</u></link></color> rich-text tags, then dispatches synthetic PointerMoveEvents across the visible rows. The Editor crashes during the pointer-move sweep
-First 5 lines of stack-trace:
0x00007FFB0297781A (Unity) TextLib::FindIntersectingLink
0x00007FFB0298AFC3 (Unity) TextLib_CUSTOM_FindIntersectingLink
0x0000014EAA72AE8D (Mono JIT Code) (wrapper managed-to-native) UnityEngine.TextCore.Text.TextLib:FindIntersectingLink_Injected (UnityEngine.Vector2&,intptr)
0x0000014EAA72ADDB (Mono JIT Code) UnityEngine.TextCore.Text.TextLib:FindIntersectingLink (UnityEngine.Vector2,intptr)
0x0000014EAA72ABCB (Mono JIT Code) UnityEngine.UIElements.UITKTextHandle:ATGFindIntersectingLink (UnityEngine.Vector2)