What I've found so far is that the return from the font_list_entities
function's call to font_get_cache is as follows

C-x 3 without evalling #[] (Emacs behaves correctly):
(1 (#<font-spec x unknown DejaVu\ LGC\ Sans\ Mono nil iso10646-1 nil nil
nil nil nil 100 nil ((user-spec . "Monospace 10"))> . []) (#<font-spec x
nil Monospace nil iso8859-1 nil nil nil nil nil nil nil ((:name .
"Monospace 10"))> . []))

M-: #[] then C-x 3 (Emacs core dumps):
(1 (#<font-spec x unknown DejaVu\ LGC\ Sans\ Mono nil iso10646-1 nil nil
nil nil nil 100 nil ((user-spec . "Monospace 10"))> . #[]) (#<font-spec x
nil Monospace nil iso8859-1 nil nil nil nil nil nil nil ((:name .
"Monospace 10"))> . #[]))

The out of place #[] becomes the val input to font_delete_unmatched.

Separately, I found that calling (eq #[] #[]) also causes the problem.
So another reproduction recipe is to let file empty-byte-code.el have
content:

  (eq #[] #[])
  (split-window-right)

Then: emacs -Q --load empty-byte-code.el

Core dump results.

The eq function seems pretty harmless, so perhaps it's worth looking
at the reader that makes a Lisp_Object out of #[]. Where would I find
that?