How often could this issue occur during your test? Is this a certain case after running the test for a couple of minutes?
It looks the device get a broken evParam as bdHandle is 0.
I think I know how this behaviour gets triggered. I had a flag in the advertisement which caused the central to iniate connect. I initated the connection from the callback when I received an advertisement with the flag set. I did not have advertisement filtering on and since I receive advertisement more faster than the time it takes to connect, this caused be to call Connect()-multiple times on the same address. After adding filtering, I have not seen this crash again.