Crash on tlsf_free when UI Elements are moved to the side by scrolling

Reproduction steps:
1. Open the “crash_prj” project
2. Open the “BeginnerMission” scene
3. Enter the Play Mode
4. Observe the crash

Expected result: The application does not crash
Actual result: The application crashes

Reproducible with: 2022.3.14f1, 2023.2.3f1, 2023.3.0a17
Could not test with: 2021.3.33f1 (error CS1061 'NavMeshSurface' does not contain a definition for 'IsPartOfPrefab' and no accessible extension method 'IsPartOfPrefab' accepting a first argument of type 'NavMeshSurface' could be found (are you missing a using directive or an assembly reference?))

Reproduced on: Windows 10
Not reproduced on: No other environments tested

Note:

• reproducible with manual scrolling by Scroll Rect (comment StartScrollDay() function in BeginnerMissionListView script and enter the Play Mode then scroll UI elements manually)
• reproducible in Player

First few stack frames:
0x00007FF6EA6A432E (Unity) tlsf_free
0x00007FF6E847F45B (Unity) DynamicHeapAllocator::Deallocate
0x00007FF6E84908CF (Unity) DualThreadAllocator<DynamicHeapAllocator>::TryDeallocate
0x00007FF6E847FCD2 (Unity) MemoryManager::Deallocate
0x00007FF6E848868A (Unity) free_alloc_internal