Found this while investigating T75197 (although this is not a fix for that).
The problem was that Cycles would store a pointer to an object in
DEGObjectIterData->templ_dupli_object. This pointer was then accessed
when the iterator was already freed.
To reproduce the crash:
- Open file.
- Render frame.
Interestingly, it does work when the order of the collections in the file is reversed. I assume in that case Cycles would store the pointer to the non-instanced object.