The crashes always occur in BatchDeleteObjects call and always at the same location:
55BC8C8A | je unityplayer.55BC8CE0 |
55BC8C8C | lea ecx,dword ptr ds:[eax+eax*2] |
55BC8C8F | mov eax,dword ptr ds:[esi+11C] |
55BC8C95 | lea edx,dword ptr ds:[eax+ecx*2] |
55BC8C98 | mov eax,dword ptr ds:[esi+10C] |
55BC8C9E | movzx ecx,word ptr ds:[eax+edi*2] |
55BC8CA2 | movzx eax,word ptr ds:[edx] |
55BC8CA5 | shl eax,10 |
55BC8CA8 | or ecx,eax |
55BC8CAA | mov eax,dword ptr ss:[ebp-10] | <-- EAX is NULL here
55BC8CAD | mov dword ptr ds:[eax],ecx | <-- Bret Hart is right!
https://forum.unity.com/threads/batchdeleteobjects-crash-unity-5.321080/
Someone suggested to run a manual cleanup routine. Maybe you could try that?
I tried patching it to check for a null pointer and bail out, but then next times it comes with a pointer of 0x1000000, because it probably didn't clean up properly, so this is also pointless.
On my machine, it's enough to turn on highest resolution and Ultra HD Texture quality to immediately trigger it (by i.e. loading my last saved game now or opening a new game and leaving Bernards room). This always crashes it. If you want, I can give you TeamViewer access or remote debugging session to my test machine.