A user reported that UToolMenus::GenerateWidget will crash if UToolMenus::AddReferencedObject is called during the construction of a menu. Using the above in-code repro steps, I can repro this in a unit test.
I do not know of a repro in the editor but with this code
you will get a crash in UToolMenus::GenerateWidget(UToolMenu*) at ToolMenus.cpp:2119 as shown below
This crash happens because the GeneratedMenuWidget was destroyed by UToolMenus::AddReferencedObjects within the callstack of PopulateMenuBuilder two lines above the crash.
There's no existing public thread on this issue, so head over to Questions & Answers just mention UE-201151 in the post.