TreeListBox, sporadic crashes

Unfortunately for this question, I don't have a reproducable solution (I can't consistently recreate these exceptions, they occur like a race condition and thus far have only occurred in the debugger in Debug mode).  I'll include sections of related code below (it defintely seems somehow related to the use of the Style trigger, I've used the TreeListBox elsewhere without any issues).  Here's the bullet points:

• The exceptions either occurs when the theme changes or when I scroll quickly through a TreeListBox that has  40,000+ objects in it.
• I'm using the current 25.1.0 release.
• The TreeListBox is displaying hierarchical nodes.
• I'm using the TreeListBox with ChildrenBinding to a list of TreeNode objects (a INotifyProperty class using the MVVM toolkit) and the ItemsSource is set to my ObservableCollection<TreeNode>.  (The TreeNode implements an ITreeNode interface if that matters).
• I currently have two DataTemplate objects a TreeNode can represent.  I am not using the adapter currently.
• I'm using a Style Trigger to set the foreground color of a TextBlock to a Foreground property on the TreeNode.  In the Style trigger, if the Background property is null then it uses a DynamicResource to AssetResourceKeys.DocumentTextForegroundNormalBrushKey.
• One of the crashes on a null was in a class named "Marvin" when it appears to be computing a hash (perhaps an obfuscated name, not sure), including the exceptions text and stack traces below.
• There is a good chance this might be related to me interacting with the TreeListBox while it's currently being populated (whether I use TreeListBox.CreateSelectionBatch() or not).  That would be something I can address (but still wanted to share in case it helps you harden the surface).

TextBlock from XAML

<TextBlock
    FontWeight="{Binding FontWeight}"
    Text="{Binding Name, Mode=OneWay}">
    <TextBlock.Style>
        <Style TargetType="TextBlock">
            <Setter Property="Foreground" Value="{Binding Foreground}" />
            <Style.Triggers>
                <DataTrigger Binding="{Binding Foreground, Mode=OneWay}" Value="{x:Null}">
                    <Setter Property="Foreground" Value="{DynamicResource {x:Static themes:AssetResourceKeys.DocumentTextForegroundNormalBrushKey}}" />
                </DataTrigger>
            </Style.Triggers>
        </Style>
    </TextBlock.Style>
</TextBlock>

TreeListBox XAML

<grids:TreeListBox
    x:Name="TreeListBox"
    Grid.Row="1"
    AlternationCount="2"
    IsRootItemVisible="True"
    ItemCollapsed="TreeListBox_ItemCollapsed"
    ItemCollapsing="TreeListBox_ItemCollapsing"
    ItemExpanded="TreeListBox_ItemExpanded"
    ItemExpanding="TreeListBox_ItemExpanding"
    ItemMenuRequested="TreeListBox_ItemMenuRequested"
    ItemTemplateSelector="{StaticResource TreeNodeTemplateSelector}"
    ItemsSource="{Binding Items, RelativeSource={RelativeSource AncestorType=UserControl}}"
    MouseDoubleClick="TreeListBox_OnMouseDoubleClick"
    PreviewKeyDown="TreeListBox_OnPreviewKeyDown"
    SelectionChanged="TreeListBox_OnSelectionChanged">

    <grids:TreeListBox.ItemAdapter>
        <!--
            An example of using bindings on the adapter, but it's better to not use bindings if you have a large tree...
            use method overrides like in DefaultTreeListBoxItemAdapter in that case instead
        -->
        <grids:TreeListBoxItemAdapter
            ChildrenBinding="{Binding Children, Mode=OneTime}"
            IsExpandedBinding="{Binding IsExpanded, Mode=TwoWay}"
            IsSelectedBinding="{Binding IsSelected, Mode=TwoWay}" />
    </grids:TreeListBox.ItemAdapter>

    <grids:TreeListBox.DataFilter>
        <t:TreeNodeFilter x:Name="Filter" />
    </grids:TreeListBox.DataFilter>
</grids:TreeListBox>

Exceptions:

The output char buffer is too small to contain the decoded characters, encoding codepage '65001' and fallback 'System.Text.DecoderExceptionFallback'. (Parameter 'chars')

The output char buffer is too small to contain the decoded characters, encoding codepage '65001' and fallback 'System.Text.DecoderExceptionFallback'. (Parameter 'chars')
   at System.Text.Encoding.ThrowCharsOverflow(DecoderNLS decoder, Boolean nothingDecoded)
   at System.Text.Encoding.GetCharsWithFallback(ReadOnlySpan`1 bytes, Int32 originalBytesLength, Span`1 chars, Int32 originalCharsLength, DecoderNLS decoder, Boolean throwForDestinationOverflow)
   at System.Text.UTF8Encoding.GetCharsWithFallback(ReadOnlySpan`1 bytes, Int32 originalBytesLength, Span`1 chars, Int32 originalCharsLength, DecoderNLS decoder, Boolean throwForDestinationOverflow)
   at System.Text.Encoding.GetCharsWithFallback(Byte* pOriginalBytes, Int32 originalByteCount, Char* pOriginalChars, Int32 originalCharCount, Int32 bytesConsumedSoFar, Int32 charsWrittenSoFar, DecoderNLS decoder)
   at System.Text.Encoding.GetChars(Byte* pBytes, Int32 byteCount, Char* pChars, Int32 charCount, DecoderNLS decoder)
   at System.Text.Decoder.GetChars(ReadOnlySpan`1 bytes, Span`1 chars, Boolean flush)
   at System.Runtime.Serialization.Json.JsonEncodingStreamWrapper.Write(ReadOnlySpan`1 buffer)
   at System.Runtime.Serialization.Json.JsonEncodingStreamWrapper.Write(Byte[] buffer, Int32 offset, Int32 count)
   at System.Xml.XmlStreamNodeWriter.FlushBuffer()
   at System.Xml.XmlStreamNodeWriter.GetBuffer(Int32 count, Int32& offset)
   at System.Xml.XmlStreamNodeWriter.UnsafeWriteUTF8Chars(Char* chars, Int32 charCount)
   at System.Runtime.Serialization.Json.XmlJsonWriter.WriteEscapedJsonString(String str)
   at System.Runtime.Serialization.Json.XmlJsonWriter.WriteString(String text)
   at WriteVisualElementToJson(XmlWriterDelegator, Object, XmlObjectSerializerWriteContextComplexJson, ClassDataContract, XmlDictionaryString[])
   at System.Runtime.Serialization.Json.JsonClassDataContract.WriteJsonValueCore(XmlWriterDelegator jsonWriter, Object obj, XmlObjectSerializerWriteContextComplexJson context, RuntimeTypeHandle declaredTypeHandle)
   at System.Runtime.Serialization.Json.XmlObjectSerializerWriteContextComplexJson.WriteDataContractValue(DataContract dataContract, XmlWriterDelegator xmlWriter, Object obj, RuntimeTypeHandle declaredTypeHandle)
   at System.Runtime.Serialization.XmlObjectSerializerWriteContext.InternalSerialize(XmlWriterDelegator xmlWriter, Object obj, Boolean isDeclaredType, Boolean writeXsiType, Int32 declaredTypeID, RuntimeTypeHandle declaredTypeHandle)
   at WriteVisualTreeMutationEventToJson(XmlWriterDelegator, Object, XmlObjectSerializerWriteContextComplexJson, ClassDataContract, XmlDictionaryString[])
   at System.Runtime.Serialization.Json.JsonClassDataContract.WriteJsonValueCore(XmlWriterDelegator jsonWriter, Object obj, XmlObjectSerializerWriteContextComplexJson context, RuntimeTypeHandle declaredTypeHandle)
   at System.Runtime.Serialization.Json.XmlObjectSerializerWriteContextComplexJson.WriteDataContractValue(DataContract dataContract, XmlWriterDelegator xmlWriter, Object obj, RuntimeTypeHandle declaredTypeHandle)
   at System.Runtime.Serialization.XmlObjectSerializerWriteContext.InternalSerialize(XmlWriterDelegator xmlWriter, Object obj, Boolean isDeclaredType, Boolean writeXsiType, Int32 declaredTypeID, RuntimeTypeHandle declaredTypeHandle)
   at WriteArrayOfVisualTreeMutationEventToJson(XmlWriterDelegator, Object, XmlObjectSerializerWriteContextComplexJson, CollectionDataContract)
   at System.Runtime.Serialization.Json.XmlObjectSerializerWriteContextComplexJson.WriteDataContractValue(DataContract dataContract, XmlWriterDelegator xmlWriter, Object obj, RuntimeTypeHandle declaredTypeHandle)
   at System.Runtime.Serialization.XmlObjectSerializerWriteContext.InternalSerialize(XmlWriterDelegator xmlWriter, Object obj, Boolean isDeclaredType, Boolean writeXsiType, Int32 declaredTypeID, RuntimeTypeHandle declaredTypeHandle)
   at WriteMutationListToJson(XmlWriterDelegator, Object, XmlObjectSerializerWriteContextComplexJson, ClassDataContract, XmlDictionaryString[])
   at System.Runtime.Serialization.Json.JsonClassDataContract.WriteJsonValueCore(XmlWriterDelegator jsonWriter, Object obj, XmlObjectSerializerWriteContextComplexJson context, RuntimeTypeHandle declaredTypeHandle)
   at System.Runtime.Serialization.Json.XmlObjectSerializerWriteContextComplexJson.WriteDataContractValue(DataContract dataContract, XmlWriterDelegator xmlWriter, Object obj, RuntimeTypeHandle declaredTypeHandle)
   at System.Runtime.Serialization.Json.DataContractJsonSerializer.InternalWriteObjectContent(XmlWriterDelegator writer, Object graph)
   at System.Runtime.Serialization.Json.DataContractJsonSerializer.InternalWriteObject(XmlWriterDelegator writer, Object graph)
   at System.Runtime.Serialization.XmlObjectSerializer.WriteObjectHandleExceptions(XmlWriterDelegator writer, Object graph, DataContractResolver dataContractResolver)
   at Microsoft.VisualStudio.DesignTools.TapContract.Networking.Message.SerializeToBuffer(Int32 messageType, Int32 requestId, Object payload)
   at Microsoft.VisualStudio.DesignTools.TapContract.Networking.Message..ctor(Int32 messageType, Object payload)
   at Microsoft.VisualStudio.DesignTools.TapContract.Networking.ProtocolHandler.PostMessage(Int32 messageType, Object jsonObject)
   at Microsoft.VisualStudio.DesignTools.WpfTap.WpfVisualTreeService.VisualTree.DispatcherVisualTreeContext.NotifyHost()
   at Microsoft.VisualStudio.DesignTools.WpfTap.WpfVisualTreeService.VisualTree.DispatcherVisualTreeContext.ProcessPendingObjects(DispatcherPriority invokePriority, Int32 processingTime)
   at Microsoft.VisualStudio.DesignTools.WpfTap.WpfVisualTreeService.VisualTree.DispatcherVisualTreeContext.<ScheduleAsyncProcessing>b__83_0(Object obj)
   at System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Int32 numArgs)
   at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object source, Delegate callback, Object args, Int32 numArgs, Delegate catchHandler)

Object reference not set to an instance of an object.

Object reference not set to an instance of an object.
   at System.Marvin.ComputeHash32(Byte& data, UInt32 count, UInt32 p0, UInt32 p1)
   at System.Windows.ComponentResourceKey.GetHashCode()
   at System.Collections.Hashtable.ContainsKey(Object key)
   at System.Windows.FrameworkElement.FindResourceInTree(FrameworkElement feStart, FrameworkContentElement fceStart, DependencyProperty dp, Object resourceKey, Object unlinkedParent, Boolean allowDeferredResourceReference, Boolean mustReturnDeferredResourceReference, DependencyObject boundaryElement, InheritanceBehavior& inheritanceBehavior, Object& source)
   at System.Windows.FrameworkElement.FindResourceInternal(FrameworkElement fe, FrameworkContentElement fce, DependencyProperty dp, Object resourceKey, Object unlinkedParent, Boolean allowDeferredResourceReference, Boolean mustReturnDeferredResourceReference, DependencyObject boundaryElement, Boolean isImplicitStyleLookup, Object& source)
   at System.Windows.StyleHelper.GetChildValueHelper(UncommonField`1 dataField, ItemStructList`1& valueLookupList, DependencyProperty dp, DependencyObject container, FrameworkObject child, Int32 childIndex, Boolean styleLookup, EffectiveValueEntry& entry, ValueLookupType& sourceType, FrameworkElementFactory templateRoot)
   at System.Windows.StyleHelper.GetChildValue(UncommonField`1 dataField, DependencyObject container, Int32 childIndex, FrameworkObject child, DependencyProperty dp, FrugalStructList`1& childRecordFromChildIndex, EffectiveValueEntry& entry, ValueLookupType& sourceType, FrameworkElementFactory templateRoot)
   at System.Windows.StyleHelper.GetValueFromStyleOrTemplate(FrameworkObject fo, DependencyProperty dp, EffectiveValueEntry& entry)
   at System.Windows.FrameworkElement.GetRawValue(DependencyProperty dp, PropertyMetadata metadata, EffectiveValueEntry& entry)
   at System.Windows.FrameworkElement.EvaluateBaseValueCore(DependencyProperty dp, PropertyMetadata metadata, EffectiveValueEntry& newEntry)
   at System.Windows.DependencyObject.EvaluateEffectiveValue(EntryIndex entryIndex, DependencyProperty dp, PropertyMetadata metadata, EffectiveValueEntry oldEntry, EffectiveValueEntry newEntry, OperationType operationType)
   at System.Windows.DependencyObject.UpdateEffectiveValue(EntryIndex entryIndex, DependencyProperty dp, PropertyMetadata metadata, EffectiveValueEntry oldEntry, EffectiveValueEntry& newEntry, Boolean coerceWithDeferredReference, Boolean coerceWithCurrentValue, OperationType operationType)
   at System.Windows.StyleHelper.OnBindingValueInStyleChanged(Object sender, BindingValueChangedEventArgs e)
   at System.Windows.Data.BindingExpression.TransferValue(Object newValue, Boolean isASubPropertyChange)
   at System.Windows.Data.BindingExpression.Activate(Object item)
   at System.Windows.Data.BindingExpression.HandlePropertyInvalidation(DependencyObject d, DependencyPropertyChangedEventArgs args)
   at System.Windows.DependentList.InvalidateDependents(DependencyObject source, DependencyPropertyChangedEventArgs sourceArgs)
   at System.Windows.DependencyObject.NotifyPropertyChange(DependencyPropertyChangedEventArgs args)
   at System.Windows.DependencyObject.UpdateEffectiveValue(EntryIndex entryIndex, DependencyProperty dp, PropertyMetadata metadata, EffectiveValueEntry oldEntry, EffectiveValueEntry& newEntry, Boolean coerceWithDeferredReference, Boolean coerceWithCurrentValue, OperationType operationType)
   at System.Windows.TreeWalkHelper.OnInheritablePropertyChanged(DependencyObject d, InheritablePropertyChangeInfo info, Boolean visitedViaVisualTree)
   at System.Windows.DescendentsWalker`1.WalkLogicalChildren(FrameworkElement feParent, FrameworkContentElement fceParent, IEnumerator logicalChildren)
   at System.Windows.DescendentsWalker`1.WalkFrameworkElementLogicalThenVisualChildren(FrameworkElement feParent, Boolean hasLogicalChildren)
   at System.Windows.DescendentsWalker`1.IterateChildren(DependencyObject d)
   at System.Windows.DescendentsWalker`1.VisitNode(DependencyObject d, Boolean visitedViaVisualTree)
   at System.Windows.DescendentsWalker`1.WalkFrameworkElementLogicalThenVisualChildren(FrameworkElement feParent, Boolean hasLogicalChildren)
   at System.Windows.DescendentsWalker`1.IterateChildren(DependencyObject d)
   at System.Windows.DescendentsWalker`1.StartWalk(DependencyObject startNode, Boolean skipStartNode)
   at System.Windows.TreeWalkHelper.InvalidateOnInheritablePropertyChange(FrameworkElement fe, FrameworkContentElement fce, InheritablePropertyChangeInfo info, Boolean skipStartNode)
   at System.Windows.FrameworkElement.OnPropertyChanged(DependencyPropertyChangedEventArgs e)
   at System.Windows.DependencyObject.NotifyPropertyChange(DependencyPropertyChangedEventArgs args)
   at System.Windows.DependencyObject.UpdateEffectiveValue(EntryIndex entryIndex, DependencyProperty dp, PropertyMetadata metadata, EffectiveValueEntry oldEntry, EffectiveValueEntry& newEntry, Boolean coerceWithDeferredReference, Boolean coerceWithCurrentValue, OperationType operationType)
   at System.Windows.DependencyObject.SetValueCommon(DependencyProperty dp, Object value, PropertyMetadata metadata, Boolean coerceWithDeferredReference, Boolean coerceWithCurrentValue, OperationType operationType, Boolean isInternal)
   at System.Windows.Controls.ContentPresenter.EnsureTemplate()
   at System.Windows.Controls.ContentPresenter.OnPreApplyTemplate()
   at System.Windows.FrameworkElement.ApplyTemplate()
   at System.Windows.FrameworkElement.MeasureCore(Size availableSize)
   at System.Windows.UIElement.Measure(Size availableSize)
   at System.Windows.ContextLayoutManager.UpdateLayout()
   at System.Windows.ContextLayoutManager.UpdateLayoutCallback(Object arg)
   at System.Windows.Media.MediaContext.FireInvokeOnRenderCallbacks()
   at System.Windows.Media.MediaContext.RenderMessageHandlerCore(Object resizedCompositionTarget)
   at System.Windows.Media.MediaContext.RenderMessageHandler(Object resizedCompositionTarget)
   at System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Int32 numArgs)
   at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object source, Delegate callback, Object args, Int32 numArgs, Delegate catchHandler)

System.AccessViolationException: 'Attempted to read or write protected memory. This is often an indication that other memory is corrupt.'

Null stack trace.  Happens in DataModelBase.cs in the "public IDataModel Parent" property on this return (obfuscated):

if (j6o.IsAlive)
{
    return j6o.Target as IDataModel;
}