I can so far only produce this with magit[1], but I've attached the output
of "bt full" below.

1. Open up a diff in magit (e.g., M-x magit-status then RET on the first
line).
2. Press RET on an added line.
3. In the opened buffer, do M-: (setq display-line-numbers t)
4. C-x b RET
5. Press RET on the line again.

If I use (e)debug to try and trace the function call, then for whatever
reason it doesn't crash at step 5, but a call to `list-buffers' will
then crash. It also doesn't crash if I use (call-interactively
#'magit-diff-visit-file) rather than hitting RET, even though RET is
bound to `magit-diff-visit-file'.

Footnotes:

[1] https://github.com/magit/magit