How to reproduce:
1. Open the user's attached project
2. Open "SlotGame" Scene
3. Enter and Exit Play Mode
4. Repeat step 3 until the Editor crashes

Reproducible with: 2019.4.32f1, 2020.3.23f1, 2021.2.4f1
Could not test with: 2022.1.0a16 (wasn't able to repro for a long time)

Notes:
- If the Editor didn't crash for 30 minutes or so, restart the Editor
- The reproduction of the issue might take longer than an hour

First lines of stack traces:
0x00007FF7A0179E95 (Unity) GetOrCreateObjectStoredInField
0x00007FF79D53CB0F (Unity) GeneralMonoObjectToTransferFor<ConfigSettingsRead>
0x00007FF7A0176E44 (Unity) Transfer_ManagedObject<StreamedBinaryRead,0>
0x00007FF79D53BFDB (Unity) ExecuteSerializationCommands<ConfigSettings

0x0000004680107183 (Mono JIT Code) (wrapper managed-to-native) UnityEngine.Behaviour:get_enabled (UnityEngine.Behaviour)
0x000000467dd3ebdb (Mono JIT Code) [TMPro_UGUI_Private.cs:4517] TMPro.TextMeshProUGUI:SetActiveSubMeshes (bool)
0x0000004680101d11 (Mono JIT Code) [TMPro_UGUI_Private.cs:221] TMPro.TextMeshProUGUI:OnDisable ()
0x00000046c8a73268 (Mono JIT Code) (wrapper runtime-invoke) object:runtime_invoke_void__this__ (object,intptr,intptr,intptr)

0x00007ff7bf7d887b (Unity) LinearCollectionField::LinearCollectionField
0x00007ff7bf7b07df (Unity) TransferField_LinearCollection<ReportScriptingObjectsTransfer>
0x00007ff7bdfaedc6 (Unity) ExecuteSerializationCommands<ConfigSettingsRead>
0x00007ff7bf7d67d2 (Unity) Transfer_ManagedObject<StreamedBinaryWrite,0>