I'm glad you figured it out because I would never have guessed that. Seeing this reminded me of yet another way I've managed to crash the client before.
I just tested it, and after more than 2 years it still does it, and it has got to be related to your tooltip issue.
Lua Code:
local m = CreateFrame("DressUpModel")
m:SetScript("OnUpdateModel", function(self)
self:Hide()
end)
m:SetModel("spells/errorcube.m2")
Hiding the frame is causing a race condition or something. I can only assume the client is still trying to access it which causes the crash.
I guess we'll need to be careful about hiding frames while they're being updated.