This bug can be triggered from comparing 2 blueprints that is almost identical but have the same hash map variable that use integer as key with different values within them.
The issue is int32 PropertyIndex = TryReadIndex(PropertyChain, I);
TryReadIndex will increase I and for a map property, the first property is the map class with the second one is the key that is different.
As the code enter const FMapProperty* MapProperty = CastField(ResolvedProperty)
ensure((I + 1 < PropertyChain.Num()) will always fail
Once you have blueprint classes fits the condition, diffing the 2 will always crash the editor. Tested in stock 5.7