Crash on UI::Canvas::UpdateEventIndexesRecursive when a script modifies nested Canvases in Play mode while using command line argument -debugallocator

How to reproduce:
1. Open the attached “IN-115489” project with the command line argument “-debugallocator”
2. Open the “SampleScene”
3. Enter Play mode
4. Click the button
5. Observe the crash

Reproducible with: 2023.1.0a12, 6000.0.58f1, 6000.2.0b2, 6000.2.6f1
Not reproducible with: 6000.3.0b3, 6000.4.0a1
Fixed in: 6000.3.0a1
Could not test with: 2023.1.0a11 (Could not solve package errors from downgrading)

Reproduced on: Windows 10 (user reported), Windows 11
Not reproduced on: No other environment tested

Notes:

• Not reproducible in Player
• Sometimes, a pop-up window stating “The memory could not be read” would appear while the Editor crashes

First few lines of the stack trace:

0x00007FF8678C8BC3 (Unity) UI::Canvas::UpdateEventIndexesRecursive
0x00007FF8678C8C53 (Unity) UI::Canvas::UpdateEventIndexesRecursive
0x00007FF8678C7576 (Unity) UI::Canvas::UpdateBatchOrder
0x00007FF8678C7633 (Unity) UI::Canvas::UpdateBatches
0x00007FF8678ACCD0 (Unity) `UI::InitializeCanvasManager'::`2'::UIEventsWillRenderCanvasesRegistrator::Forward