My analysis seems to be correct.  Here is a reproducible test case that can be
turned into an eweasel test.

Freeze with attached classes and config file.
Execute system with arguments "10 10000" (10 worker threads, 10000 iterations
   each).
System crashes with run-time panic.

Stack trace is:

(dbx) bt
current thread: t@3
=>[1] eif_rt_xfree(0x0, 0x80000000, 0x14b87c8, 0x2768af8, 0xfffffff8, 0x0), at 0x145cd68
  [2] sc_stop(0x2768af8, 0x66c00, 0x1, 0x14b87c8, 0xfffffff8, 0x0), at 0x145e798
  [3] eif_mem_tiny(0xa, 0x2, 0x151f604, 0x14b87c8, 0x66e3c, 0x66c00), at 0x14832f0
  [4] F129_3598(0x1676628, 0x1bbdc8, 0x246, 0x1f35b78, 0x14b87c8, 0x14e836c), at 0x11b87f8
  [5] F583_6149(0x1676628, 0x1bbdc8, 0x246, 0x1f35b78, 0x14b87c8, 0x14e836c), at 0x7179c
  [6] F582_6146(0x1676628, 0x1e4c, 0x12d, 0x1bbc00, 0x2769298, 0x14b87c8), at 0x6f27c
  [7] A582_46(0x1676628, 0x2769298, 0x1, 0x14b87c8, 0xfffffffc, 0x0), at 0xacd34
  [8] eif_thr_entry(0x1674e78, 0x2769298, 0xaccf0, 0x1f7ea4c, 0x1674e78, 0x2768af8), at 0x1488458