Steps to reproduce:
1. Download and extract the attached user's project "il2cpp_ts_repro.zip"
2. Build the Windows x64 player by running "Unity.exe -batchmode -nographics -quit -projectPath <project> -executeMethod BuildRepro.Build -logFile build.log"
3. Open "Repro\il2cpp_ts_repro.sln" Visual Studio solution, Build it and wait for the Player to exit (about 10 seconds)
4. Observe the exit code in "repro_result.txt" in "%USERPROFILE%\AppData\LocalLow\DefaultCompany\il2cpp_ts_repro"

Actual result: The Player exits with code 3 or 7 and reports that the ref struct ThreadStatic, static and static readonly (.cctor) slots still point at objects the GC has reclaimed (use-after-free)
Expected result: The Player exits with code 0 and reports "OK: every pool survived every collection."

Reproducible with: 6000.0.1f1, 6000.0.84f1, 6000.3.25f1, 6000.6.5f1, 7000.0.0a8
Not reproducible with: 6000.7.0b4

Testing Environment: Windows 11
Not reproducible on: no other environment tested

Notes:
-Reproduces with IL2CPP, Release configuration and Incremental GC enabled (the default); the build script applies these settings
-Il2cpp.exe does not emit "Il2CppCodeGenWriteBarrier" after storing a reference into a static or [ThreadStatic] field declared on a ref struct, while the identical store on a plain static class does get the barrier
-In the user's project this results in a 0xC0000005 crash in "List<T>.Add" via ZLogger's "ZLoggerInterpolatedStringHandler" (a ref struct with a [ThreadStatic] static List<string> pool)
-"BuildRepro.Build" is the user's original build method, which produces a Visual Studio solution in "Build/Repro/" instead