I just noticed this today, so must be a very recent regression.

Repro steps:
 1) Launch Chrome OS (on Linux)
 2) Navigate to chrome://md-settings
 3) Add chrome://md-settings to the startup url list.
 4) Close browser.
 5) Launch Chrome OS (this time it navigates to chrome://md-settings automatically).

I get the following crash

[14550:14550:0209/133648.766966:FATAL:web_ui_message_handler.h(103)] Check failed: IsJavascriptAllowed(). Cannot CallJavascriptFunction before explicitly allowing JavaScript.
#0 0x7f399d850c57 base::debug::StackTrace::StackTrace()
#1 0x7f399d86b6ea logging::LogMessage::~LogMessage()
#2 0x7f399fa4a570 chromeos::settings::StylusHandler::SendHasStylus()
#3 0x7f3998572310 ui::DeviceDataManager::NotifyObserversDeviceListsComplete()
#4 0x7f399d8516ee base::debug::TaskAnnotator::RunTask()
#5 0x7f399d873ded base::MessageLoop::RunTask()
#6 0x7f399d874645 base::MessageLoop::DoWork()
#7 0x7f399d8759b9 base::MessagePumpGlib::Run()
#8 0x7f399d873b28 base::MessageLoop::RunHandler()
#9 0x7f399d89e0fe base::RunLoop::Run()
#10 0x7f399e86053e ChromeBrowserMainParts::MainMessageLoopRun()
#11 0x7f399b19cad9 content::BrowserMainLoop::RunMainMessageLoopParts()
#12 0x7f399b1a027d content::BrowserMainRunnerImpl::Run()
#13 0x7f399b1981de content::BrowserMain()
#14 0x7f399b7c71ec content::ContentMainRunnerImpl::Run()
#15 0x7f399b7c5df0 content::ContentMain()
#16 0x7f399e09a190 ChromeMain
#17 0x7f39935b0f45 __libc_start_main
#18 0x7f399e099fed <unknown>

Received signal 6
#0 0x7f399d850c57 base::debug::StackTrace::StackTrace()
#1 0x7f399d8507df base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7f399d575330 <unknown>
#3 0x7f39935c5c37 gsignal
#4 0x7f39935c9028 abort
#5 0x7f399d84eaa2 base::debug::BreakDebugger()
#6 0x7f399d86b9dc logging::LogMessage::~LogMessage()
#7 0x7f399fa4a570 chromeos::settings::StylusHandler::SendHasStylus()
#8 0x7f3998572310 ui::DeviceDataManager::NotifyObserversDeviceListsComplete()
#9 0x7f399d8516ee base::debug::TaskAnnotator::RunTask()
#10 0x7f399d873ded base::MessageLoop::RunTask()
#11 0x7f399d874645 base::MessageLoop::DoWork()
#12 0x7f399d8759b9 base::MessagePumpGlib::Run()
#13 0x7f399d873b28 base::MessageLoop::RunHandler()
#14 0x7f399d89e0fe base::RunLoop::Run()
#15 0x7f399e86053e ChromeBrowserMainParts::MainMessageLoopRun()
#16 0x7f399b19cad9 content::BrowserMainLoop::RunMainMessageLoopParts()
#17 0x7f399b1a027d content::BrowserMainRunnerImpl::Run()
#18 0x7f399b1981de content::BrowserMain()
#19 0x7f399b7c71ec content::ContentMainRunnerImpl::Run()
#20 0x7f399b7c5df0 content::ContentMain()
#21 0x7f399e09a190 ChromeMain
#22 0x7f39935b0f45 __libc_start_main
#23 0x7f399e099fed <unknown>
  r8: ffffb51d809d8d38  r9: ffffb51d809d8d28 r10: 0000000000000008 r11: 0000000000000202
 r12: 0000351b51388a30 r13: 00007ffdd0ebe360 r14: 00007ffdd0ebdf88 r15: 00007ffdd0ebdf78
  di: 00000000000038d6  si: 00000000000038d6  bp: 00007ffdd0ebe360  bx: 0000000000000000
  dx: 0000000000000006  ax: 0000000000000000  cx: ffffffffffffffff  sp: 00007ffdd0ebd998
  ip: 00007f39935c5c37 efl: 0000000000000202 cgf: 0000000000000033 erf: 0000000000000000
 trp: 0000000000000000 msk: 0000000000000000 cr2: 0000000000000000
[end of stack trace]