Crash on tlsf_free when rendering UI Toolkit panel in World Space on a specific project

Reproduction steps:
1. Open the attached project "CrashRepro"
2. Switch scene view draw mode between wireframe/shaded wireframe/unlit/shaded a few times

Expected result: Draw mode is changed
Actual result: Editor crashes

Reproducible with: 6000.1.0a10, 6000.1.5f1, 6000.2.0a9
Not reproducible with: 2022.3.61f1, 6000.0.51f1, 6000.1.0a9

Reproducible on: Windows 11
Not reproducible on: macOS Sequoia 15.5 (M3 Pro)

Note: Reporter mentioned that just moving the camera was enough to crash, but this could not be reproduced locally by CQA.

First few lines of stack trace:

0x00007FFAE2DA5F19 (Unity) tlsf_free
0x00007FFAE08F9FEF (Unity) DynamicHeapAllocator::Deallocate
0x00007FFAE08F44C6 (Unity) DynamicHeapAllocator::TryDeallocate
0x00007FFAE08F3863 (Unity) DualThreadAllocator<DynamicHeapAllocator>::Reallocate