The reason it crashes is because Child doesn't get garbage collected, which is because it still has the RF_Standalone flag.
UEditorEngine::EditorDestroyWorld clears RF_Standalone flag for the persistent world. When that world gets destroyed it clears the flag from its sublevels in UWorld::DestroyWorld. Child is not in the UWorld.Levels array, which it should be.
This seems to happen because Parent level is being opened before the Asset Registry has loaded. ULevelStreaming::AsyncLevelLoadComplete would usually add the level to the UWorld.Levels array, but it's not happening because it loads a redirector instead of a level. If the Asset Registry was loaded it would've loaded the sublevel just fine on first attempt since FSoftObjectPath::PreSavePath would've fixed the path.
My suspicion is that ULevelStreaming::AsyncLevelLoadComplete isn't correctly handling loading a redirector to a hidden sublevel, it will load the sublevel but it doesn't have a code path that leads to the sublevel ending up in the parent persistent world's UWorld.Levels array.
This was causing our project major problems after some levels got moved which we had to get around by deleting the redirector assets and hardcoding them into our game's code via manual calls to GRedirectCollector.AddAssetPathRedirection to make sure the redirection was fixed at the time the parent levels were opened.
Steps to reproduce:
There's no existing public thread on this issue, so head over to Questions & Answers just mention UE-104253 in the post.