I made a log with UART redirection of a non-crashing start. I've also attached my debug logging code.
No crash
...
00000650: SS:_mkdir:A/CHDK/EDGE
00000660: SS:_Open(A/CHDK/DATA/RBTEST.cfg,0x301,0x1ff)
00000660: SS:_Open:4
00000680: SS:_Close:4
....
Crash
...
00000660: SS:_mkdir:A/CHDK/EDGE
00000670: SS:_Open(A/CHDK/CCHDK4.CFG,0x301,0x1ff)
00000670: SS:_Open:4
00000690: SS:_Close:4
00000740: SS:_Open(A/CHDK/DATA/RBTEST.cfg,0x301,0x1ff)
Since it doesn't get the the return of Open, it presumably crashed here. This matches the earlier stack trace evidence pointing toward the script CFG.
The obvious difference is the crash case saves CCHDK4.CFG to reset the autostart setting. However, this happens in the same task as the cfg save so it's not obvious to me why it should crash.
In the case of autostart, there really should be no need to save the script cfg, since the menu settings couldn't have been modified (as an aside, the cfg saving logic is buggy anyway, if you just go and edit the menu settings and don't run the script, it sometimes doesn't get saved)
edit:
The script cfg is saved when the CHDK cfg is saved, so skipping the save_params_values() in script_start_gui doesn't help.