Very nice !
Quite a nasty, stealth bug...
It is due to LLTexLayerSetBuffer being still LLRefCounted, instead of LLThreadSafeRefCounted like it now should be, given all texture classes have been changed to be thread-safe ref-counted, due to how GL textures can be created in shared OpenGL threads...
Fixed for next release. If you compile the viewer yourself, simply change line 44 of linden/indra/llappearance/lltexlayer.h to read:
Thanks for the report (and crash dump, which got me right to the point) !