I just got back from the work but I'm more than happy to provide whatever information you need (long as I can figure it out. I'll try it and edit this post)
I also discovered one thing: It's not the client exiting that causes it to crash. Rather, it's closing the layer (it be clicking on layer's close tab, or deleting the layer). I opened the project, did sprite, and removed the layer tab, and it crashed just same.
I tried 28.3 version, pasted it over with your patch, and they all crashed same.
EDIT: Tried the windbg but I'm having problem with pdb path. I'm about to pass out so I shall go sleep. Will be back tomorrow.