I’ve tried this about a dozen times and I can get the app to crash every time:
1. In any document, create a new layer separate from the Background layer.
2. Draw any selection into any layer and then load that selection as a mask into the layer created in step 1.
3. Deselect the selection.
4. Use the paint bucket tool to fill the layer created in Step 1 (not the mask) with color. Immediately upon clicking in the layer, the app crashes.
Works every time, but only if you follow these instructions in the exact order given. Any intermediary steps seem to quash the bug before it becomes a problem, e.g., if you brush into the layer before using the paint bucket tool, it won't crash when you use the paint bucket.