This might not be the issue, but I have seen a broadly similar crash, where some code incorrectly calls FMemory::Free (possibly via another mechanism, such as the delete operator) with a valid memory pointer that was allocated by another allocator, not FMemory::Malloc. Later on, that memory is cleaned up by the allocator that owns it and FMallocBinned is left with a pointer to invalid memory in its list of free blocks, and it doesn’t blow up until some unrelated code tries to allocate some memory.
If you suspect this is what’s happening, you could try looking at any code that’s not part of standard UE4 (third party plugins, your own code, etc) that might be using its own memory allocator, or using features that change allocation behaviour such as FMemStack, or code that overrides the new and delete operators, and look for any possible bugs there.
Good luck!