Steps to reproduce:

Create a new project
Import the attached Repro_SelectorMatcherCrash.cs into Assets/
Open any Editor window so a live UI Toolkit panel exists (the Inspector is fine)
Run QA > CRASH UIToolkit selector matcher from the menu bar and confirm the dialog
Observe the Editor

The script writes a stylesheet containing a malformed value (backdrop-filter: 5px), attaches it to an element with siblings, deletes that asset while the element still references it, then forces style re-resolution. All three steps are required.

Actual results: Crash in UIToolkit::NativeSelectorMatcher::MatchSheetFlat

Obtained 51 stack frames.
#0  UIToolkit::MatchDescriptorRangeFlat(...)
#1  UIToolkit::NativeSelectorMatcher::MatchSheetFlat(...)
#2  (wrapper managed-to-native) UnityEngine.UIElements.StyleSheets.NativeSelectorMatcher:MatchSheetFlat
#3  UnityEngine.UIElements.StyleSheets.StyleSelectorHelper:MatchSheetNative (...) [StyleSelectorHelper.cs :: 144]
#4  UnityEngine.UIElements.StyleSheets.StyleSelectorHelper:FindMatches (...) [StyleSelectorHelper.cs :: 230]
#5  UnityEngine.UIElements.VisualTreeStyleUpdaterTraversal:TraverseRecursive (...) [VisualTreeStyleUpdater.cs :: 416]
#6  UnityEngine.UIElements.StyleSheets.HierarchyTraversal:Traverse (...) [HierarchyTraversal.cs :: 12]
#7  UnityEngine.UIElements.VisualTreeStyleUpdaterTraversal:Traverse (...) [VisualTreeStyleUpdater.cs :: 296]

Expected results: Deleting a StyleSheet asset must invalidate or detach the selector data still held by elements that reference it. A later style resolution must never walk destroyed native data, and a malformed style value must never corrupt matcher state.

Reproducible with versions: 6000.7.0b1, 6000.7.0b2, 7000.0.0a1

Not reproducible with versions: 6000.5.5f1, 6000.6.2f1, 6000.7.0a6

Can't test with versions: 6000.0.84f1, 6000.3.25f1 (filter and backdrop-filter properties do not exist)

Tested on (OS): macOS 15 (Darwin 25.6.0), Apple Silicon