I can get the Plugin Host demo to crash about 1 in 10 times when I repeatedly add a 'MIDI Input' node and delete it again using the GUI.
Deleting the MIDI Input node via the GUI results in this call sequence:
GUI -> FilterGraph::removeFilter() -> AudioProcessorGraph::removeNode() -> ... AudioGraphIOProcessor::setParentGraph(nullptr)
... trouble is that AudioGraphIOProcessor will be running on the audio thread until AudioProcessorGraph gets round to updating the rendering op sequence. The crash happens in AudioGraphIOProcessor::processBlock() when it tries to use the null graph pointer.
Although I'm not aware of all the subtleties, it looks like one possible fix is simply to remove the call to setParentGraph(nullptr) in AudioProcessorGraph::removeNode(). It seems like there's no need for it because the node is about to get deleted once the render op list is swapped and it drops its refcount on the node.