There seems to be a race in destruction of the DefaultBrowserWorker used by ChromeAppDelegate::NewWindowContentsDelegate::OpenURLFromTab. If I'm not mistaken, it's possible for the UI thread to handle DefaultWebClientWorker::OnCheckIsDefaultComplete before the FILE thread finishes handling DefaultWebClientWorker::CheckIsDefault, leading to the caller's callback being destroyed on the FILE thread rather than the UI thread.

https://crash.corp.google.com/browse?q=product.name%3D%27Chrome%27%20AND%20custom_data.ChromeCrashProto.ptype%3D%27browser%27%20AND%20custom_data.ChromeCrashProto.magic_signature_1.name%3D%27%5BAssert%5D%20content%3A%3ANotificationServiceImpl%3A%3ARemoveObserver%27%20OMIT%20RECORD%20IF%20SUM(CrashedStackTrace.StackFrame.SourceFileName%20CONTAINS%20%27shell_integration%27)%20%3D%200&ignore_case=false&enable_rewrite=false&omit_field_name=&omit_field_value=&omit_field_opt=&stbtiq=&reportid=&index=0