Reproduced the crash in my test case.
Simplified test which still crashes.
More simplifications, and still crashing.
Further simplifications.
Added gcd variant which uses a wait call instead.
Add wait variant of the test app which also reproduces the crash.
Set multiForSocket before calling curl_multi_remove_handle.

It appears that the socket callbacks can get called in this situation. This didn't happen whilst we were setting the CURLOPT_CONNECTTIMEOUT option, but without that set, it appears to be possible.