Make a mutator just with this snippet:

array<jjLAYER@> layerOrderings;
void onLevelBegin() {
	layerOrderings = jjLayerOrderGet();
	for (uint i = 0; i < layerOrderings.length(); i++) {
		jjLAYER@ copy = jjLAYER(layerOrderings[i]);
	}
}

Cycle to ezrivellon.j2l (https://www.jazz2online.com/downloads/9443/rivellon/) with the mutator on several times until access violation occurs. Seems to happen at the same instruction address each time it happens: https://i.imgur.com/UHq6Brf.png

Tested with JJ2+ v6.0a in Windows 10.

I haven't had any time to look into this yet (and I'm guessing the true is same for everyone else), but this is a good report, crashing at the same address can't be too hard to track down probably, thank you.