Michał, is the binding of buffer-undo-list significant for your reproduction (i.e., did the original crash happen in an undo-disabled buffer)?