Crash on scripting_array_length when Undoing Element creation in a UI Document while using In-Scene UI Authoring

Steps to reproduce:

1. Create and open a new URP 3D Project
2. In the project Settings > UI Toolkit panel enable "Enable in-scene UI Authoring" flag
3. In a Scene create a PanelRenderer Game Object and assign a new "Source Asset" in it's Component
4. In the Hierarchy click the left arrow icon > that's to the right of the PanelRenderer's Child GameObject to edit the UIDocument outside of UI Builder
5. In the Hierarchy create a couple UI Toolkit > Standard Elements and Save
6. Delete one of the Standard Elements and Save
7. Undo

Actual results: Crashes on scripting_array_length

Expected results: No Errors or crashes when undoing

Reproducible with versions: 6000.6.0b1, 6000.7.0a1

Can’t test with versions: 6000.0.78f1, 6000.3.18f1, 6000.4.12f1, 6000.5.1f1 (No In-Scene Authoring)

Tested on (OS): Windows 11

First lines of Stack Trace:

0x00007FFBD77AFC89 (Unity) scripting_array_length
0x00007FFBD7001801 (Unity) LinearCollectionField::GetArray
0x00007FFBD66139DD (Unity) TransferField_LinearCollection<ConfigSettingsRead>
0x00007FFBD434DCA6 (Unity) <lambda_0e72d06f1e873aaca754327d82c4ab17>::operator()
0x00007FFBD434EF8D (Unity) SerializeTraits<ReferencedObjectData<0> >::ExecuteSerializationCommandsFunctor<ConfigSettingsRead>::operator()