crash after switching map from admin menu

[eduzappa18]

There is a crash that happens when a map is changed using a custom admin menu

if the admin menu uses the additem command to change maps with a wait 1000 at the end
the server crashes 100% of the time after the map is loaded. (tested with and without mods installed)

This crash does NOT happen on reborn or vanilla servers

Steps to reproduce the crash:

1. copy this menu and save it as mapchage.urc inside the main/ui folder (client install)

menu "mapchange" 640 480 FROM_TOP 0.3
align centerx centery
borderstyle 3D_BORDER
bgcolor 0.094117 0.094117 0.094117 0.8

resource
ListBox
{
	rect 10 10 620 460
	fgcolor 1 1 1 1.00
	bgcolor 0.160784 0.160784 0.160784 0.90
	borderstyle "NONE"
	font "courier-20"

	additem ""
	additem "mohdm6 | Stalingrad (crash)"    "rcon say switching to map: Stalingrad!; wait 1000;rcon set g_gametype 3;wait 1000;rcon map dm/mohdm6;wait 1000;"
	additem "mohdm6 | Stalingrad (no crash)" "rcon say switching to map: Stalingrad!; wait 1000;rcon set g_gametype 3;wait 1000;rcon map dm/mohdm6;"
	additem ""
}

1. Load any map
2. open console and type togglemenu mapchange
3. change map to Stalingrad (crash)
4. the server changes map and crashes

this are the last lines in the logfile (right after the map changes)

------ Server Initialization Complete ------  2.06 seconds
soundtrack switched to music/mohdm6.mus.
playing music/mohdm6.mus
music set to normal with fallback normal
Loading Ambient.scr
Zappa : dropped gamestate, resending
SV_SendClientGameState() for Zappa
Going from CS_CONNECTED to CS_PRIMED for Zappa
clientCommand: Zappa : 3 : mohdm6 | Stalingrad (crash)
Cvar_Set2: g_scoreboardpicover 

Game version :
only tested on allied assault NightFall version 1.2.1 (stable)

[mohabhassan]

Please use the crash report issue template when posting such issues.
Does this need to be from inside a menu? Can't you just type the crash command in console?

[mohabhassan]

Also, please post crash dumps if found in main/nightfall/crashes folder

[eduzappa18]

it doesn't happen when it's typed in the console.
I guess it could be related to the clientcommand the player sends right after joining the map

and it's not giving any crash dump

[vs98-dev]

I got a crash log on my test:
https://uploadnow.io/f/TG6G0Fg