Doesn't seem to happen in all folders, but I can repro it reliably in /bin:

Steps to reproduce:

1. Open FileManager
2. Navigate to /bin
3. Right-click on the right hand side (not on a file) and select the "Hide dotfiles" option. Repeat toggling this until it crashes

CrashDaemon(18): --- Backtrace for thread #0 (TID 77) ---
CrashDaemon(18): 0xedededed: ???
CrashDaemon(18): 0x2c29a0bc: [libcore.so] AK::HashTable<AK::HashMap<AK::String, AK::NonnullOwnPtr<Core::Property>, AK::Traits<AK::String> >::Entry, AK::HashMap<AK::String, AK::NonnullOwnPtr<Core::Property>, AK::Traits<AK::String> >::EntryTraits>::~HashTable() +0x6c (kmalloc.h:69)
CrashDaemon(18): 0x2c299b25: [libcore.so] Core::Object::~Object() +0x265 (Atomic.h:266)
CrashDaemon(18): 0x2c296feb: [libcore.so] Core::Notifier::~Notifier() +0x5b (Notifier.cpp:45)
CrashDaemon(18): 0x2c29701c: [libcore.so] Core::Notifier::~Notifier() +0x1c (kmalloc.h:69)
CrashDaemon(18): 0x2c289089: [libcore.so] Core::FileWatcher::~FileWatcher() +0x109 (RefCounted.h:119)
CrashDaemon(18): 0x409cb83a: [libgui.so] GUI::FileSystemModel::Node::~Node() +0x15a (kmalloc.h:69)
CrashDaemon(18): 0x409cb753: [libgui.so] GUI::FileSystemModel::Node::~Node() +0x73 (kmalloc.h:69)
CrashDaemon(18): 0x409cb753: [libgui.so] GUI::FileSystemModel::Node::~Node() +0x73 (kmalloc.h:69)
CrashDaemon(18): 0x409c875a: [libgui.so] GUI::FileSystemModel::update() +0xba (kmalloc.h:69)
CrashDaemon(18): 0x98f7fd06: [/bin/FileManager] run_in_windowed_mode(AK::RefPtr<Core::ConfigFile, AK::RefPtrTraits<Core::ConfigFile> >, AK::String, AK::String)::{lambda()#3}::operator()() const +0x46 (Atomic.h:266)
CrashDaemon(18): 0x98f801db: [/bin/FileManager] AK::Function<void (GUI::Action&)>::CallableWrapper<run_in_windowed_mode(AK::RefPtr<Core::ConfigFile, AK::RefPtrTraits<Core::ConfigFile> >, AK::String, AK::String)::{lambda(auto:1&)#30}>::call(GUI::Action&) const +0x4b (Atomic.h:266)
CrashDaemon(18): 0x40965ed6: [libgui.so] GUI::Action::activate(Core::Object*) +0x106 (Atomic.h:266)
CrashDaemon(18): 0x40a646e8: [libgui.so] GUI::WindowServerConnection::handle(Messages::WindowClient::MenuItemActivated const&) +0x58 (WindowServerConnection.cpp:263)
CrashDaemon(18): 0x40a687d0: [libgui.so] .L5938 +0x20 (WindowClientEndpoint.h:2269)
CrashDaemon(18): 0x40a682c8: [libgui.so] IPC::Connection<WindowClientEndpoint, WindowServerEndpoint>::handle_messages() +0xa8 (OwnPtr.h:191)
CrashDaemon(18): 0x40a683d4: [libgui.so] AK::Function<void ()>::CallableWrapper<IPC::Connection<WindowClientEndpoint, WindowServerEndpoint>::Connection(WindowClientEndpoint&, AK::NonnullRefPtr<Core::LocalSocket>)::{lambda()#2}>::call() const +0x64 (Atomic.h:266)
CrashDaemon(18): 0x2c297e4c: [libcore.so] Core::Object::dispatch_event(Core::Event&, Core::Object*) +0x7c (Object.h:103)
CrashDaemon(18): 0x2c2810a4: [libcore.so] Core::EventLoop::pump(Core::EventLoop::WaitMode) +0x3e4 (Atomic.h:266)
CrashDaemon(18): 0x2c28166b: [libcore.so] Core::EventLoop::exec() +0x4b (EventLoop.cpp:390)
CrashDaemon(18): 0x40968b95: [libgui.so] GUI::Application::exec() +0x25 (Application.cpp:121)
CrashDaemon(18): 0x98f8ba71: [/bin/FileManager] run_in_windowed_mode(AK::RefPtr<Core::ConfigFile, AK::RefPtrTraits<Core::ConfigFile> >, AK::String, AK::String) +0x4861 (main.cpp:1113)
CrashDaemon(18): 0x98f6f070: [/bin/FileManager] main +0x1710 (RefPtr.h:74)
CrashDaemon(18): 0x98f6f475: [/bin/FileManager] _start +0x45 (crt0_shared.cpp:60)