It does look more and more like this is some kind of memory stomping. So you could try passing -stompmalloc or -stomp2malloc on the cmd line to see if those throw out anything useful. You can also try an ASAN build to see if that catches anything. That’s a bit more involved - you have to run UBT with the -EnableASan argument*.*
In terms of tracking down the asset, does the this pointer look valid? UAnimMontage::TickAssetPlayer should be being called on the montage asset for which you’re updating the montage instance. It’s also worth mentioning that UAnimMontage::TickAssetPlayer is only called on montages that are being blended via sync marker blending, so it has to be a montage asset that has UAnimMontage::SyncGroup set. If you go higher up the callstack, you may also be able to see the sync group.