apply {{} {
  set a [join {a b} {}]
  puts [string length [string replace ___! 0 2 $a]]  ;# doesn't crash
  puts [string length [string replace ___! 0 2 $a[unset a]]]  ;# crashes
}}

it looks like it can happen when the replacement is unshared (suggesting it's trying to edit in place?)

possible cause at tclExecute.c:5705 - the only way into that block is when value3Ptr is unshared, then it's used as the result, and the refcount is subsequently decremented, and the result obj gets freed.