Make a mutator just with this snippet:

array<jjLAYER@> layerOrderings;
void onLevelBegin() {
	layerOrderings = jjLayerOrderGet();
	for (uint i = 0; i < layerOrderings.length(); i++) {
		jjLAYER@ copy = jjLAYER(layerOrderings[i]);
	}
}

Cycle to ezrivellon.j2l (https://www.jazz2online.com/downloads/9443/rivellon/) with the mutator on several times until access violation occurs. Seems to happen at the same instruction address each time it happens: https://i.imgur.com/UHq6Brf.png

Tested with JJ2+ v6.0a in Windows 10.

I haven't had any time to look into this yet (and I'm guessing the true is same for everyone else), but this is a good report, crashing at the same address can't be too hard to track down probably, thank you.

Okay! It looks like the jjLAYER copy constructor was confusing widthReal and widthRounded, trying to read unrelated memory. The extra memory it read never got used for anything, so there was no way to observe the issue except for this apparently very occasional crash. Fixed in 6.0b.