I can trigger this reliably by having N-C-E set as the font for
a particular character or range in my fontset, then inserting
said character (or having said character displayed and then tweaking
the fontset).

If I use Noto Emoji for that range (or explicitly use any other font
which _doesn't_ have a glyph for the triggering character) then
nothing bad happens other than a missing-glyph box in the buffer window.

I think the attempt to open the font kills the X connection as a side 
effect (presumably we're Doing Something Wrong) which then triggers the
rest of the crash once unblock_input() happens.

Backtrace attached.