But here is one attachment with a caught player.
This situation is not really random.
Those days I stumbled around my own old development with Doom/Heretic/Hexen and thought it's time to get it running on Win7 too. While testing I came around that situation. which caused a crash (but just because my member-data-handling). Checking around what happened the last decade for that all in the net, I gladly found your dengine - a very fine piece of hard work as it looks. Had to test the situation - and - voila!
Will not dig into your sources now, that'd be too much, but if it has any relationship to the old code, check pspecialdata of a polyobject. The problem appears then if you run with the player against a rotate-polyobject, so that ThrustMobj will be called. When it comes to the condition "if (pe->IsRotatePoly())" (...similar ofc), pe is already dead meat, but not a pointer anymore (probably changed by acs). I couldn't find where that value changed exactly, so I made a simple hack comparing pe to 0xfeeefeee (that's always the value it gets then). If it has that value, set force=0 and bypass the IsRotatePoly()-request. That way it couldn't trap me anymore.
Perhaps I'm gonna try to check if I noted some more critical situations and check how they behave in dengine. Can't be wrong to see it from another side. But so far - pressing thumbs for your future works. Viva the old dinosaurs