Crashes: mono_custom_attrs_from_class -> g_free -> Access Violation

We're seeing various crashes (in standalone builds) in beta 17 (possibly before as well) that can all be tracked down to System.MonoCustomAttrs, e.g.:

10001E31 (mono) g_free
10001DDD (mono) g_free
1006A003 (mono) mono_custom_attrs_from_class
10073C63 (mono) mono_reflection_get_custom_attrs_info
10034FA1 (mono) mono_domain_finalize
0598CEA8 (Mono JIT Code) (wrapper managed-to-native) System.MonoCustomAttrs:IsDefinedInternal (System.Reflection.ICustomAttributeProvider,System.Type)
0598C9B2 (Mono JIT Code) [/Users/builduser/buildslave/mono-runtime-and-classlibs/build/mcs/class/corlib/System/MonoCustomAttrs.cs:298] System.MonoCustomAttrs:IsDefined (System.Reflection.ICustomAttributeProvider,System.Type,bool)
0598C8BD (Mono JIT Code) [/Users/builduser/buildslave/mono-runtime-and-classlibs/build/mcs/class/corlib/System/MonoType.cs:580] System.MonoType:IsDefined (System.Type,bool)
0598BF8E (Mono JIT Code) [/Users/builduser/buildslave/mono-runtime-and-classlibs/build/mcs/class/corlib/System/Enum.cs:1035] System.Enum:Format (System.Type,object,string)
0598B936 (Mono JIT Code) [/Users/builduser/buildslave/mono-runtime-and-classlibs/build/mcs/class/corlib/System/Enum.cs:720] System.Enum:ToString (string)
0598B80A (Mono JIT Code) [/Users/builduser/buildslave/mono-runtime-and-classlibs/build/mcs/class/corlib/System/Enum.cs:704] System.Enum:ToString ()
[...]

or

10001D2A (mono) g_free
1006A06E (mono) mono_custom_attrs_from_class
10073C63 (mono) mono_reflection_get_custom_attrs_info
10073F7F (mono) mono_reflection_get_custom_attrs_by_type
10034FF8 (mono) mono_domain_finalize
05537641 (Mono JIT Code) (wrapper managed-to-native) System.MonoCustomAttrs:GetCustomAttributesInternal (System.Reflection.ICustomAttributeProvider,System.Type,bool)
0553742D (Mono JIT Code) [/Users/builduser/buildslave/mono-runtime-and-classlibs/build/mcs/class/corlib/System/MonoCustomAttrs.cs:108] System.MonoCustomAttrs:GetCustomAttributesBase (System.Reflection.ICustomAttributeProvider,System.Type)
0553692F (Mono JIT Code) [/Users/builduser/buildslave/mono-runtime-and-classlibs/build/mcs/class/corlib/System/MonoCustomAttrs.cs:151] System.MonoCustomAttrs:GetCustomAttributes (System.Reflection.ICustomAttributeProvider,System.Type,bool)
055BF98A (Mono JIT Code) [/Users/builduser/buildslave/mono-runtime-and-classlibs/build/mcs/class/corlib/System/MonoType.cs:595] System.MonoType:GetCustomAttributes (System.Type,bool)
[...]

We don't have a good repo for this one, so far it's rather random but very prevalent, it's likely related to multithreading, but I'm only guessing.

Could a code review of that method show any obvious problem?
The problem has proven hard to narrow down, and I can't really upload a 15+GB project (and with no clear repo at that) ...

 

Thus far we don't have a deterministic repro, no.
We gave the game to an external QA studio for the first time on Friday and they see the problem a lot (>50% of all launches into gameplay, allegedly always when they try and launch the game via steam instead of manually, but I think that impression is incorrect). That's much more prevalent than what we were experiencing here.