I did some investigation, but I was unable to identify the problem on
the Emacs side.

I traced the code, and found that even after [[view window] close] is
called (nsterm.m L1626), [EmacsView resetCursorRects:] can still be
invoked for that window.  To my understanding, such calls are initiated
by AppKit, not in the control of Emacs.

Also, Emacs 27 and Emacs 28 (NS) also suffer from exactly the same issue
(the same invalid access).  I was unable to reproduce it using the Mac
port.  Given the severity of segfaults, I suspect it's very likely due
to upstream Cocoa changes that only cause problems on newer versions of
macOS.

I'm currently using the trivial fix to prevent further data loss: