Reproduction steps:
1. Open the attached “CrashRepro” project
2. Open the “Assets/Scenes/SampleScene.unity” scene
3. Enter the Play mode and wait a few seconds
4. If the crash doesn’t happen repeat the 3rd step a few times or pause the Play Mode and then exit it

Expected result: Error is thrown that indicates that the splineDetail value is incorrect
Actual result: The Editor crashes

Reproducible with: 9.0.2 (2022.3.14f1), 10.0.2 (2023.2.2f1, 2023.3.0a16)
Not reproducible with: 7.0.7 (2021.3.33f1) (“System.IndexOutOfRangeException: Index 128 is out of range of '128' Length.” error is spammed in the Console)

Reproducible on: macOS 14.1.1 (M1 Max), Windows 10
Not reproducible on: No other environment tested

The first few lines of the stack trace:
#0 0x00000107692ae8 in block_merge_next
#1 0x00000105498620 in DynamicHeapAllocator::Deallocate(void*)
#2 0x000001054a5fd0 in DelayedPointerDeletionManager::CleanupPendingMainThreadPointers()
#3 0x000001054a63b4 in DualThreadAllocator<DynamicHeapAllocator>::Allocate(unsigned long, int)
#4 0x0000010549a9d8 in MemoryManager::Allocate(unsigned long, unsigned long, MemLabelId const&, AllocateOptions, char const*, int)
#5 0x00000105499c90 in operator new(unsigned long, MemLabelId const&, unsigned long, char const*, int)
#6 0x00000105115b74 in Event_CUSTOM_Internal_Copy(void*)