Got the same crash while clicking on windows (might have been closing one, not sure):

(gdb) bt

+ Trace 234372

$1 = (MetaWindowActor *) 0x583de80
(gdb) p *self
$2 = {parent = {parent_instance = {g_type_instance = {g_class = 0x3fa0800}, ref_count = 1, qdata = 0x5216051}, flags = 16, private_flags = 0, priv = 0x583db80}, priv = 0x583daf0}
(gdb) p *self->priv
$3 = {window = 0x0, compositor = 0x2fdf780, surface = 0x0, focused_shadow = 0x0, unfocused_shadow = 0x0, shape_region = 0x0, shadow_clip = 0x0, shadow_shape = 0x0, shadow_class = 0x0, send_frame_messages_timer = 0, frame_drawn_time = 27605971656, repaint_scheduled_id = 0, size_changed_id = 249872, minimize_in_progress = 0, unminimize_in_progress = 0, maximize_in_progress = 0, unmaximize_in_progress = 0, map_in_progress = 0, destroy_in_progress = 0, frames = 0x505b140, freeze_count = 0, visible = 0, disposed = 1, needs_frame_drawn = 1, repaint_scheduled = 0, needs_reshape = 0, recompute_focused_shadow = 0, recompute_unfocused_shadow = 0, needs_destroy = 1, no_shadow = 0, updates_frozen = 0, first_frame_state = 2}

Note how

send_frame_messages_timer = 0,
disposed = 1,
needs_destroy = 1

which, looking at the code, means that the timeout handler shouldn't be getting called at all, right?

I think the 2nd patch in bug 738686 should fix this. Unfortunately it's not easy to reproduce. I think I was ^C a gtk+ 3 CSD window when this happened but can't repro now.

*** This bug has been marked as a duplicate of bug 738686 ***