Click the button. A popup opens and is immediately minimized. While minimized, the popup loads a resource that requires HTTP Basic auth, which queues a window-modal sheet child with wants_to_be_visible_=true, window_visible_=false (deferred at SetVisibilityState() because the ancestor window is not visible).
After ~2s the popup is restored on a non-active Space (so OrderChildren() early-returns at the !window.onActiveSpace gate and the sheet stays deferred). The popup then requests fullscreen with the user activation it obtained from the click. Inside the AppKit fullscreen transition, windowDidEnterFullScreen: → FullscreenControllerTransitionComplete() → OrderChildren() finally calls ShowAsModalSheet(), which runs -[NSWindow beginSheet:...] synchronously and spins a nested run-loop.
This page spams w.close() during that ~250ms window. With state_==kFullscreen the close is not deferred, the bridge is freed inside the nested loop, and on return line 1642 dereferences freed this->host_.