Crash on TextCore::OTL_TableReader::GetOpenTypeLayoutTables when using Japanese Font as TMP Fallback

Reproduction steps:
1. Open the attached project "CrashRepro" and open “Assets/Scenes/SampleScene.unity“
2. Enable “Canvas/Enable Me Will Crash“ GameObject in the Hierarchy window

Expected result: Text object is enabled
Actual result: Editor crashes

Reproducible with: 2022.3.65f1, 6000.0.54f1, 6000.1.12f1, 6000.2.0b10, 6000.3.0a2

Reproducible on: Windows 11
Not reproducible on: No other environment tested

First few lines of stack trace:

0x00007ff7530e668a (Unity) TextCore::OTL_TableReader::GetOpenTypeLayoutTables
0x00007ff7530eda54 (Unity) TextCore::FontEngine::PopulateOpenTypeLayoutTables
0x00007ff7530ec347 (Unity) TextCore::FontEngine::PopulateLigatureSubstitutionRecordMarshallingArray
0x00007ff751d79881 (Unity) FontEngine_CUSTOM_PopulateLigatureSubstitutionRecordMarshallingArray