Created attachment 127008 [details]
Valgrind log

I managed to get a Valgrind log, the backtrace of the first invalid read seems
consistent.

Here are the options I used, let me know if you want me to try any others:

 valgrind --tool=memcheck --error-limit=no --log-file=valgrind-%p.log -v
--trace-children=yes --track-origins=yes  --read-var-info=yes
--redzone-size=1024 --

I also noticed that the game's engine (Unity) overrides operator new and
friends, maybe that's involved somehow.