How to reproduce:
1. Open the attached “IN-115805” project
2. Open the “SampleScene”
3. Dock the “Charged Cone Attack“ VFX Graph next to the Game view window
4. Enter Play mode
5. Exit Play mode
6. Observe the crash

Reproducible with: 6000.1.0f1 (916e72a382ef), 6000.1.17f1
Not reproducible with: 6000.2.11f1, 6000.3.0b9, 6000.4.0a4
Could not test with: 6000.0.62f1, 6000.1.0b15 (could not fix errors from downgrading)

Reproduced on: Windows 11
Not reproduced on: macOS 26 (M1)

Note: Crash does not occur when “Do not reload Domain and Scene” or “Reload Scene only“ is active (Edit > Project Settings > Editor > Enter Play Mode Settings)

First few lines of the stack trace:
0x00007FF83C7F131E (Unity) EnumerateDisabledKeywordsInVariantsArray
0x00007FF83C7EF71B (Unity) CompileShaderSnippet
0x00007FF83C7F223B (Unity) GetSerializedSubProgramForShaderSnippet
0x00007FF83D669A32 (Unity) CompileSingleVariantJob
0x00007FF83C661261 (Unity) ujob_execute_job

or:
0x00007FF868204B80 (Unity) UNITY_XXH32
0x00007FF8662B68FE (Unity) ReadFromShaderCache
0x00007FF8662B1615 (Unity) GetSerializedSubProgramForShaderSnippet
0x00007FF867127902 (Unity) CompileSingleVariantJob
0x00007FF8661209D1 (Unity) ujob_execute_job