This seems to occur when the subobject is considered unreachable but is not yet pending kill/marked as garbage. In this case, IsValid returns true while FWeakObjectPtr::Get returns nullptr for the object, causing problems if the actor channel attempts to replicate the object. See linked UDN for more info.
On an actor with bReplicateUsingRegisteredSubObjectList=true, spawn subobjects with no references to them, and add these to the replicated subobjects list. In the subobject's BeginDestroy, call RemoveReplicatedSubObject on the owning actor for the object, and set UE_NET_SUBOBJECTLIST_WEAKPTR=0.
When later attempting to replicate this object, checks/ensures will be hit in places such as UNetDriver::FindOrCreateRepChangedPropertyTracker and FNetPropertyConditionManager::FindOrCreatePropertyTracker due to the object being unresolvable, and in FRepLayout::ReplicateProperties, the RepState will be null.
There's no existing public thread on this issue, so head over to Questions & Answers just mention UE-185346 in the post.