This was essentially a use-after-free issue. When a geometry nodes group changes it has to be preprocessed again before it can be evaluated. This part was working, the issue was that parent node groups have to be preprocessed as well, which was missing. The lazy-function graph cached on the parent node group was still referencing data that was freed when the child group changed. Now the depsgraph makes sure that all relevant geometry node groups are preprocessed again after a change. This issue was found by Simon Thommes.