How to reproduce:
1. Open the attached “IN-103423_CrashBugReport.zip“ project
2. Open the “Bug“ scene
3. Enter Play Mode
4. Wait until the “terrain“ SubScene is loaded
5. Select the “terrain“ SubScene in the Hierarchy

Expected result: The Editor is running
Actual result: The Editor crashes or freezes

Reproducible with: 6000.1.0a3, 6000.1.7f1, 6000.2.0b5
Not reproducible with: 2022.3.63f1, 6000.0.51f1, 6000.1.0a2. Did not repro on macOS.

Reproducible on: Windows 11
Not reproducible on: No other environment tested

Notes:

Reproducible in Player
Sometimes the Editor freezes
The crash may happen before completing the 5th step
In some cases, the stack trace can be different

First few lines of the stack trace:
mono-2.0-bdwgc.dll!mono_method_to_ir(MonoCompile * cfg, _MonoMethod * method, MonoBasicBlock * start_bblock, MonoBasicBlock * end_bblock, MonoInst * return_var, MonoInst * * inline_args, unsigned int inline_offset, int emit_check_this) Line 6138 C
mono-2.0-bdwgc.dll!inline_method(MonoCompile * cfg, _MonoMethod * cmethod, _MonoMethodSignature * fsig, MonoInst * * sp, unsigned char * ip, unsigned int real_offset, int inline_always) Line 4694 C
mono-2.0-bdwgc.dll!mono_method_to_ir(MonoCompile * cfg, _MonoMethod * method, MonoBasicBlock * start_bblock, MonoBasicBlock * end_bblock, MonoInst * return_var, MonoInst * * inline_args, unsigned int inline_offset, int emit_check_this) Line 7591 C
mono-2.0-bdwgc.dll!inline_method(MonoCompile * cfg, _MonoMethod * cmethod, _MonoMethodSignature * fsig, MonoInst * * sp, unsigned char * ip, unsigned int real_offset, int inline_always) Line 4694 C