This crash was seen several times while testing, but only with application verifier enabled on Windows.  This means it is a legit issue but may be a race condition which we don't see often.  Note that this bug was reproducible on Windows 7 but I have not seen it on Windows 10 (also using app verifier).

Exception stack (UI Thread):
0:000> k
 # ChildEBP RetAddr  
00 (Inline) -------- remoting_core!std::_Tree<std::_Tmap_traits<unsigned int,tagPOINTER_TOUCH_INFO,std::less<unsigned int>,std::allocator<std::pair<unsigned int const ,tagPOINTER_TOUCH_INFO> >,0> >::clear [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\xtree @ 1472]
01 003cec98 102cb319 remoting_core!remoting::TouchInjectorWin::Deinitialize+0xc [c:\b\build\slave\win-pgo\build\src\remoting\host\touch_injector_win.cc @ 160]
02 003cecc4 1016d112 remoting_core!remoting::`anonymous namespace'::InputInjectorWin::Core::Stop+0xb5 [c:\b\build\slave\win-pgo\build\src\remoting\host\input_injector_win.cc @ 331]
03 (Inline) -------- remoting_core!base::internal::RunMixin<base::Callback<void __cdecl(void),0,0> >::Run+0xd [c:\b\build\slave\win-pgo\build\src\base\callback.h @ 68]
04 003ced30 10131eae remoting_core!base::debug::TaskAnnotator::RunTask+0x172 [c:\b\build\slave\win-pgo\build\src\base\debug\task_annotator.cc @ 52]
05 003cf3e4 101327e5 remoting_core!base::MessageLoop::RunTask+0x2ae [c:\b\build\slave\win-pgo\build\src\base\message_loop\message_loop.cc @ 422]
06 (Inline) -------- remoting_core!base::MessageLoop::DeferOrRunPendingTask+0x58 [c:\b\build\slave\win-pgo\build\src\base\message_loop\message_loop.cc @ 430]
07 003cf490 1016d5ff remoting_core!base::MessageLoop::DoWork+0x335 [c:\b\build\slave\win-pgo\build\src\base\message_loop\message_loop.cc @ 523]
08 003cf4c0 1016d295 remoting_core!base::MessagePumpForUI::DoRunLoop+0x5f [c:\b\build\slave\win-pgo\build\src\base\message_loop\message_pump_win.cc @ 174]
09 003cf4ec 10130c54 remoting_core!base::MessagePumpWin::Run+0x55 [c:\b\build\slave\win-pgo\build\src\base\message_loop\message_pump_win.cc @ 58]
0a (Inline) -------- remoting_core!base::MessageLoop::RunHandler+0x25 [c:\b\build\slave\win-pgo\build\src\base\message_loop\message_loop.cc @ 386]
0b 003cf518 10060403 remoting_core!base::RunLoop::Run+0xb4 [c:\b\build\slave\win-pgo\build\src\base\run_loop.cc @ 38]
0c 003cf798 10060478 remoting_core!remoting::StartIt2MeNativeMessagingHost+0x49d [c:\b\build\slave\win-pgo\build\src\remoting\host\it2me\it2me_native_messaging_host_main.cc @ 192]
0d 003cf7cc 008c11d2 remoting_core!remoting::It2MeNativeMessagingHostMain+0x2b [c:\b\build\slave\win-pgo\build\src\remoting\host\it2me\it2me_native_messaging_host_main.cc @ 202]
WARNING: Stack unwind information not available. Following frames may be wrong.
0e 003cf814 75a1336a remote_assistance_host_uiaccess+0x11d2
0f 003cf820 77459902 kernel32!BaseThreadInitThunk+0xe
10 003cf860 774598d5 ntdll!__RtlUserThreadStart+0x70
11 003cf878 00000000 ntdll!_RtlUserThreadStart+0x1b

Exception record:
0:000> .exr -1
ExceptionAddress: 102d8a5d (remoting_core!std::_Tree<std::_Tmap_traits<unsigned int,tagPOINTER_TOUCH_INFO,std::less<unsigned int>,std::allocator<std::pair<unsigned int const ,tagPOINTER_TOUCH_INFO> >,0> >::clear)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000004
Attempt to read from address 00000004

This class is being destroyed because the connection had failed to reconnect and was being shut down on the network thread:
0:004> k
 # ChildEBP RetAddr  
00 05ebef44 77490258 verifier!AVrfpDphCompareNodeForTable+0x15
01 05ebef60 7748f5cb ntdll!FindNodeOrParent+0x25
02 05ebef78 71d2728d ntdll!RtlDeleteElementGenericTableAvl+0x16
03 05ebef94 71d29080 verifier!AVrfpDphFindBusyMemoryAndRemoveFromBusyList+0x6d
04 05ebefb0 774f170c verifier!AVrfDebugPageHeapFree+0x90
05 05ebeff8 774aa863 ntdll!RtlDebugFreeHeap+0x2f
06 05ebf0ec 77452bd5 ntdll!RtlpFreeHeap+0x5d
07 05ebf10c 723bac0b ntdll!RtlFreeHeap+0x142
08 05ebf12c 71cd5e9a vrfcore!VfCoreRtlFreeHeap+0x2b
09 05ebf190 75a114ad vfbasics!AVrfpRtlFreeHeap+0x11a
0a 05ebf1a4 71cd77eb kernel32!HeapFree+0x14
0b 05ebf204 10081f64 vfbasics!AVrfpHeapFree+0x10b
0c (Inline) -------- remoting_core!base::allocator::WinHeapFree+0x17 [c:\b\build\slave\win-pgo\build\src\base\allocator\winheap_stubs_win.cc @ 42]
0d 05ebf218 10081e04 remoting_core!`anonymous namespace'::DefaultWinHeapFreeImpl+0x1a [c:\b\build\slave\win-pgo\build\src\base\allocator\allocator_shim_default_dispatch_to_winheap.cc @ 48]
0e (Inline) -------- remoting_core!ShimFree+0xc [c:\b\build\slave\win-pgo\build\src\base\allocator\allocator_shim.cc @ 241]
0f 05ebf228 1005b837 remoting_core!free+0xf [c:\b\build\slave\win-pgo\build\src\base\allocator\allocator_shim_override_ucrt_symbols_win.h @ 55]
10 05ebf234 102fddc1 remoting_core!std::_Deallocate+0x48 [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\xmemory0 @ 132]
11 (Inline) -------- remoting_core!std::allocator<std::_Tree_node<std::pair<std::basic_string<char,std::char_traits<char>,std::allocator<char> > const ,std::unique_ptr<remoting::protocol::ChannelMultiplexer::MuxChannel,std::default_delete<remoting::protocol::ChannelMultiplexer::MuxChannel> > >,void *> >::deallocate+0x1b [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\xmemory0 @ 720]
12 (Inline) -------- remoting_core!std::_Wrap_alloc<std::allocator<std::_Tree_node<std::pair<std::basic_string<char,std::char_traits<char>,std::allocator<char> > const ,std::unique_ptr<remoting::protocol::ChannelMultiplexer::MuxChannel,std::default_delete<remoting::protocol::ChannelMultiplexer::MuxChannel> > >,void *> > >::deallocate+0x1b [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\xmemory0 @ 987]
13 (Inline) -------- remoting_core!std::_Tree_comp_alloc<std::_Tmap_traits<std::basic_string<char,std::char_traits<char>,std::allocator<char> >,std::unique_ptr<remoting::protocol::ChannelMultiplexer::MuxChannel,std::default_delete<remoting::protocol::ChannelMultiplexer::MuxChannel> >,std::less<std::basic_string<char,std::char_traits<char>,std::allocator<char> > >,std::allocator<std::pair<std::basic_string<char,std::char_traits<char>,std::allocator<char> > const ,std::unique_ptr<remoting::protocol::ChannelMultiplexer::MuxChannel,std::default_delete<remoting::protocol::ChannelMultiplexer::MuxChannel> > > >,0> >::_Freeheadnode+0x1b [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\xtree @ 845]
14 (Inline) -------- remoting_core!std::_Tree_comp_alloc<std::_Tmap_traits<std::basic_string<char,std::char_traits<char>,std::allocator<char> >,std::unique_ptr<remoting::protocol::ChannelMultiplexer::MuxChannel,std::default_delete<remoting::protocol::ChannelMultiplexer::MuxChannel> >,std::less<std::basic_string<char,std::char_traits<char>,std::allocator<char> > >,std::allocator<std::pair<std::basic_string<char,std::char_traits<char>,std::allocator<char> > const ,std::unique_ptr<remoting::protocol::ChannelMultiplexer::MuxChannel,std::default_delete<remoting::protocol::ChannelMultiplexer::MuxChannel> > > >,0> >::{dtor}+0x1b [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\xtree @ 726]
15 05ebf248 102fd51e remoting_core!std::_Tree<std::_Tmap_traits<std::basic_string<char,std::char_traits<char>,std::allocator<char> >,std::unique_ptr<remoting::protocol::ChannelMultiplexer::MuxChannel,std::default_delete<remoting::protocol::ChannelMultiplexer::MuxChannel> >,std::less<std::basic_string<char,std::char_traits<char>,std::allocator<char> > >,std::allocator<std::pair<std::basic_string<char,std::char_traits<char>,std::allocator<char> > const ,std::unique_ptr<remoting::protocol::ChannelMultiplexer::MuxChannel,std::default_delete<remoting::protocol::ChannelMultiplexer::MuxChannel> > > >,0> >::~_Tree<std::_Tmap_traits<std::basic_string<char,std::char_traits<char>,std::allocator<char> >,std::unique_ptr<remoting::protocol::ChannelMultiplexer::MuxChannel,std::default_delete<remoting::protocol::ChannelMultiplexer::MuxChannel> >,std::less<std::basic_string<char,std::char_traits<char>,std::allocator<char> > >,std::allocator<std::pair<std::basic_string<char,std::char_traits<char>,std::allocator<char> > const ,std::unique_ptr<remoting::protocol::ChannelMultiplexer::MuxChannel,std::default_delete<remoting::protocol::ChannelMultiplexer::MuxChannel> > > >,0> >+0x2a [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\xtree @ 1092]
16 05ebf258 102fd4b7 remoting_core!remoting::protocol::ChannelMultiplexer::~ChannelMultiplexer+0x53 [c:\b\build\slave\win-pgo\build\src\remoting\protocol\channel_multiplexer.cc @ 315]
17 05ebf264 102f3938 remoting_core!remoting::protocol::ChannelMultiplexer::`scalar deleting destructor'+0xb
18 (Inline) -------- remoting_core!std::default_delete<remoting::protocol::ChannelMultiplexer>::operator()+0x6 [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\memory @ 1195]
19 (Inline) -------- remoting_core!std::unique_ptr<remoting::protocol::ChannelMultiplexer,std::default_delete<remoting::protocol::ChannelMultiplexer> >::reset+0x2d [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\memory @ 1432]
1a 05ebf284 102e68c5 remoting_core!remoting::protocol::IceTransport::~IceTransport+0x39 [c:\b\build\slave\win-pgo\build\src\remoting\protocol\ice_transport.cc @ 39]
1b 05ebf290 102e6847 remoting_core!remoting::protocol::IceConnectionToClient::~IceConnectionToClient+0x6a [c:\b\build\slave\win-pgo\build\src\remoting\protocol\ice_connection_to_client.cc @ 70]
1c 05ebf29c 102dd060 remoting_core!remoting::protocol::IceConnectionToClient::`scalar deleting destructor'+0xb
1d (Inline) -------- remoting_core!std::default_delete<remoting::protocol::ConnectionToClient>::operator()+0x5 [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\memory @ 1195]
1e (Inline) -------- remoting_core!std::unique_ptr<remoting::protocol::ConnectionToClient,std::default_delete<remoting::protocol::ConnectionToClient> >::reset+0x3b [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\memory @ 1432]
1f 05ebf2b8 102dd006 remoting_core!remoting::ClientSession::~ClientSession+0x46 [c:\b\build\slave\win-pgo\build\src\remoting\host\client_session.cc @ 92]
20 05ebf2c4 102cf62d remoting_core!remoting::ClientSession::`scalar deleting destructor'+0xb
21 (Inline) -------- remoting_core!std::default_delete<remoting::ClientSession>::operator()+0x7 [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\memory @ 1195]
22 (Inline) -------- remoting_core!std::unique_ptr<remoting::ClientSession,std::default_delete<remoting::ClientSession> >::{dtor}+0xd [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\memory @ 1397]
23 (Inline) -------- remoting_core!std::allocator<std::unique_ptr<remoting::ClientSession,std::default_delete<remoting::ClientSession> > >::destroy+0xd [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\xmemory0 @ 744]
24 (Inline) -------- remoting_core!std::allocator_traits<std::allocator<std::unique_ptr<remoting::ClientSession,std::default_delete<remoting::ClientSession> > > >::destroy+0xd [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\xmemory0 @ 864]
25 (Inline) -------- remoting_core!std::_Wrap_alloc<std::allocator<std::unique_ptr<remoting::ClientSession,std::default_delete<remoting::ClientSession> > > >::destroy+0xd [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\xmemory0 @ 1003]
26 (Inline) -------- remoting_core!std::_Destroy_range1+0xd [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\xmemory0 @ 1101]
27 (Inline) -------- remoting_core!std::_Destroy_range+0xd [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\xmemory0 @ 1118]
28 (Inline) -------- remoting_core!std::vector<std::unique_ptr<remoting::ClientSession,std::default_delete<remoting::ClientSession> >,std::allocator<std::unique_ptr<remoting::ClientSession,std::default_delete<remoting::ClientSession> > > >::_Destroy+0xd [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\vector @ 1581]
29 (Inline) -------- remoting_core!std::vector<std::unique_ptr<remoting::ClientSession,std::default_delete<remoting::ClientSession> >,std::allocator<std::unique_ptr<remoting::ClientSession,std::default_delete<remoting::ClientSession> > > >::erase+0x4c [c:\b\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\vector @ 1487]
2a 05ebf324 102ddfc0 remoting_core!remoting::ChromotingHost::OnSessionClosed+0xa6 [c:\b\build\slave\win-pgo\build\src\remoting\host\chromoting_host.cc @ 211]
2b 05ebf3f4 102e6b96 remoting_core!remoting::ClientSession::OnConnectionClosed+0x158 [c:\b\build\slave\win-pgo\build\src\remoting\host\client_session.cc @ 362]
2c 05ebf41c 102f25af remoting_core!remoting::protocol::IceConnectionToClient::OnSessionStateChange+0x51 [c:\b\build\slave\win-pgo\build\src\remoting\protocol\ice_connection_to_client.cc @ 177]
2d 05ebf42c 102f150a remoting_core!remoting::protocol::JingleSession::SetState+0x20 [c:\b\build\slave\win-pgo\build\src\remoting\protocol\jingle_session.cc @ 760]
2e 05ebf44c 102e6937 remoting_core!remoting::protocol::JingleSession::Close+0xb6 [c:\b\build\slave\win-pgo\build\src\remoting\protocol\jingle_session.cc @ 389]
2f 05ebf464 102e6cad remoting_core!remoting::protocol::IceConnectionToClient::Disconnect+0x18 [c:\b\build\slave\win-pgo\build\src\remoting\protocol\ice_connection_to_client.cc @ 89]
30 05ebf47c 102f411d remoting_core!remoting::protocol::IceConnectionToClient::OnIceTransportError+0x18 [c:\b\build\slave\win-pgo\build\src\remoting\protocol\ice_connection_to_client.cc @ 194]
31 05ebf484 102ff2f6 remoting_core!remoting::protocol::IceTransport::OnChannelFailed+0xa [c:\b\build\slave\win-pgo\build\src\remoting\protocol\ice_transport.cc @ 169]
32 05ebf4bc 1014575c remoting_core!remoting::protocol::IceTransportChannel::TryReconnect+0x3a [c:\b\build\slave\win-pgo\build\src\remoting\protocol\ice_transport_channel.cc @ 267]
33 (Inline) -------- remoting_core!base::internal::RunMixin<base::Callback<void __cdecl(void),1,1> >::Run+0x5 [c:\b\build\slave\win-pgo\build\src\base\callback.h @ 85]
34 05ebf4dc 1016d112 remoting_core!base::Timer::RunScheduledTask+0xac [c:\b\build\slave\win-pgo\build\src\base\timer\timer.cc @ 229]
35 (Inline) -------- remoting_core!base::internal::RunMixin<base::Callback<void __cdecl(void),0,0> >::Run+0xd [c:\b\build\slave\win-pgo\build\src\base\callback.h @ 68]
36 05ebf548 10131eae remoting_core!base::debug::TaskAnnotator::RunTask+0x172 [c:\b\build\slave\win-pgo\build\src\base\debug\task_annotator.cc @ 52]
37 05ebfbfc 10132020 remoting_core!base::MessageLoop::RunTask+0x2ae [c:\b\build\slave\win-pgo\build\src\base\message_loop\message_loop.cc @ 422]
38 05ebfc10 101328c9 remoting_core!base::MessageLoop::DeferOrRunPendingTask+0x30 [c:\b\build\slave\win-pgo\build\src\base\message_loop\message_loop.cc @ 430]
39 05ebfc94 1016dcb1 remoting_core!base::MessageLoop::DoDelayedWork+0xb9 [c:\b\build\slave\win-pgo\build\src\base\message_loop\message_loop.cc @ 562]
3a 05ebfd88 1016d295 remoting_core!base::MessagePumpForIO::DoRunLoop+0x91 [c:\b\build\slave\win-pgo\build\src\base\message_loop\message_pump_win.cc @ 485]
3b 05ebfdb4 10130c54 remoting_core!base::MessagePumpWin::Run+0x55 [c:\b\build\slave\win-pgo\build\src\base\message_loop\message_pump_win.cc @ 58]
3c (Inline) -------- remoting_core!base::MessageLoop::RunHandler+0x25 [c:\b\build\slave\win-pgo\build\src\base\message_loop\message_loop.cc @ 386]
3d 05ebfde0 10073820 remoting_core!base::RunLoop::Run+0xb4 [c:\b\build\slave\win-pgo\build\src\base\run_loop.cc @ 38]
3e 05ebfee0 10141c72 remoting_core!remoting::AutoThread::ThreadMain+0x114 [c:\b\build\slave\win-pgo\build\src\remoting\base\auto_thread.cc @ 231]
3f 05ebff14 71cd0fd8 remoting_core!base::`anonymous namespace'::ThreadFunc+0x162 [c:\b\build\slave\win-pgo\build\src\base\threading\platform_thread_win.cc @ 86]
40 05ebff50 75a1336a vfbasics!AVrfpStandardThreadFunction+0x48
41 05ebff5c 77459902 kernel32!BaseThreadInitThunk+0xe
42 05ebff9c 774598d5 ntdll!__RtlUserThreadStart+0x70
43 05ebffb4 00000000 ntdll!_RtlUserThreadStart+0x1b