Crash on tlsf_free when exiting the Play mode in a specific project

Reproduction steps:
1. Open the attached project "CrashRepro"
2. Enter the Play mode
3. Press space a few times
4. Exit the Play mode

Expected result: The Play mode stops
Actual result: Editor crashes

Reproducible with: 2022.3.20f1, 2023.2.10f1, 2023.3.0b8
Couldn’t test with: 2021.3.35f1 - “error CS0234: The type or namespace name 'Properties' does not exist in the namespace 'Unity' “

Reproducible on: Windows 10
Not reproducible on: No other environment tested

First few lines of stack trace:

0x00007ff6fb4041b4 (Unity) tlsf_free
0x00007ff6f91d08db (Unity) DynamicHeapAllocator::Deallocate
0x00007ff6f91de4c2 (Unity) DelayedPointerDeletionManager::CleanupPendingMainThreadPointersInternal
0x00007ff6f91ddc44 (Unity) DualThreadAllocator<DynamicHeapAllocator>::Allocate
0x00007ff6f91cf731 (Unity) MemoryManager::Allocate

Notes:
Can freeze instead of crash, sometimes crashes silently
Can crash a few seconds after entering the Play mode