This crash was not present in Friday's canary but is present in today's, which is 52.0.2711.0.

Steps to reproduce:
1) Have an extension installed with a hidden icon
2) Click on the browser menu button

The browser crashes within a few seconds. This crash is 100% reproducible for me. It seems very similar to https://crbug.com/603241, but the repro steps are much simpler and the stack trace is different.

Sample crash ID: 209ae51200000000
Sample crash stack:

Thread 0 CRASHED [EXC_BAD_INSTRUCTION / 0x00000001 @ 0x000000010bffbe2c ] MAGIC SIGNATURE THREAD
0x000000010bffbe2c	(Google Chrome Framework -objc_zombie.mm:235 )	(anonymous namespace)::ZombieObjectCrash(objc_object*, objc_selector*, objc_selector*)
0x000000010bffbc50	(Google Chrome Framework -objc_zombie.mm:270 )	-[CrZombie forwardingTargetForSelector:]
0x00007fff8e83f20b	(CoreFoundation + 0x0008520b )	___forwarding___
0x00007fff8e83f0f7	(CoreFoundation + 0x000850f7 )	__forwarding_prep_0___
0x000000010eea98b5	(Google Chrome Framework -browser_actions_controller.mm:274 )	(anonymous namespace)::ToolbarActionsBarBridge::IsAnimating() const
0x000000010efe8f4a	(Google Chrome Framework -toolbar_actions_bar.cc:600 )	ToolbarActionsBar::ShowToolbarActionBubble(std::__1::unique_ptr<ToolbarActionsBarBubbleDelegate, std::__1::default_delete<ToolbarActionsBarBubbleDelegate> >)
0x000000010efea2db	(Google Chrome Framework -bind_internal.h:181 )	base::internal::Invoker<base::IndexSequence<0ul, 1ul>, base::internal::BindState<base::internal::RunnableAdapter<void (ToolbarActionsBar::*)(std::__1::unique_ptr<ToolbarActionsBarBubbleDelegate, std::__1::default_delete<ToolbarActionsBarBubbleDelegate> >)>, void (ToolbarActionsBar*, std::__1::unique_ptr<ToolbarActionsBarBubbleDelegate, std::__1::default_delete<ToolbarActionsBarBubbleDelegate> >), base::WeakPtr<ToolbarActionsBar>, base::internal::PassedWrapper<std::__1::unique_ptr<ToolbarActionsBarBubbleDelegate, std::__1::default_delete<ToolbarActionsBarBubbleDelegate> > > >, base::internal::InvokeHelper<true, void, base::internal::RunnableAdapter<void (ToolbarActionsBar::*)(std::__1::unique_ptr<ToolbarActionsBarBubbleDelegate, std::__1::default_delete<ToolbarActionsBarBubbleDelegate> >)> >, void ()>::Run(base::internal::BindStateBase*)
0x000000010be7602a	(Google Chrome Framework -callback.h:397 )	base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&)
0x000000010be97a72	(Google Chrome Framework -message_loop.cc:479 )	base::MessageLoop::RunTask(base::PendingTask const&)
0x000000010be97d8b	(Google Chrome Framework -message_loop.cc:488 )	base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&)
0x000000010be981fa	(Google Chrome Framework -message_loop.cc:638 )	base::MessageLoop::DoDelayedWork(base::TimeTicks*)
0x000000010be6b52c	(Google Chrome Framework -message_pump_mac.mm:334 )	base::MessagePumpCFRunLoopBase::RunWork()
0x000000010be8df99	(Google Chrome Framework + 0x00586f99 )	base::mac::CallWithEHFrame(void () block_pointer)
0x000000010be6af13	(Google Chrome Framework -message_pump_mac.mm:306 )	base::MessagePumpCFRunLoopBase::RunWorkSource(void*)
0x00007fff8e864880	(CoreFoundation + 0x000aa880 )	__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__
0x00007fff8e843fbb	(CoreFoundation + 0x00089fbb )	__CFRunLoopDoSources0
0x00007fff8e8434de	(CoreFoundation + 0x000894de )	__CFRunLoopRun
0x00007fff8e842ed7	(CoreFoundation + 0x00088ed7 )	CFRunLoopRunSpecific
0x00007fff8ab5d934	(HIToolbox + 0x00030934 )	RunCurrentEventLoopInMode
0x00007fff8ab5d76e	(HIToolbox + 0x0003076e )	ReceiveNextEventCommon
0x00007fff8ab5d5ae	(HIToolbox + 0x000305ae )	_BlockUntilNextEventMatchingListInModeWithFilter
0x00007fff98303ef9	(AppKit + 0x00048ef9 )	_DPSNextEvent
0x00007fff98303329	(AppKit + 0x00048329 )	-[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:]
0x00007fff982f7e83	(AppKit + 0x0003ce83 )	-[NSApplication run]
0x000000010be6bd25	(Google Chrome Framework -message_pump_mac.mm:665 )	base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*)
0x000000010be6b363	(Google Chrome Framework -message_pump_mac.mm:238 )	base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)
0x000000010beaddf2	(Google Chrome Framework -run_loop.cc:35 )	base::RunLoop::Run()
0x000000010b9a24a7	(Google Chrome Framework -chrome_browser_main.cc:1855 )	ChromeBrowserMainParts::MainMessageLoopRun(int*)
0x000000010f205e56	(Google Chrome Framework -browser_main_loop.cc:949 )	content::BrowserMainLoop::RunMainMessageLoopParts()
0x000000010f208431	(Google Chrome Framework -browser_main_runner.cc:154 )	content::BrowserMainRunnerImpl::Run()
0x000000010f201c1c	(Google Chrome Framework -browser_main.cc:46 )	content::BrowserMain(content::MainFunctionParams const&)
0x000000010be2de63	(Google Chrome Framework -content_main_runner.cc:742 )	content::ContentMainRunnerImpl::Run()
0x000000010be2d265	(Google Chrome Framework -content_main.cc:20 )	content::ContentMain(content::ContentMainParams const&)
0x000000010b909b91	(Google Chrome Framework -chrome_main.cc:84 )	ChromeMain
0x000000010b6a0d41	(Google Chrome Canary -chrome_exe_main_mac.c:87 )	main
0x000000010b6a0b23	(Google Chrome Canary + 0x00000b23 )	start