hair_out_mesh and hair_in_mesh implicitly shares edges CustomData. In hair_create_input_mesh(), edge data of hair_in_mesh needs to be updated and therefore a new address is allocated. In the subsequent frames, psys->clmd->clothObject->edges points to freed memory block. Therefore, Blender crashes.
By freeing hair_out_mesh first,
1. in hair_create_input_mesh(), at least edge data copying is avoided
2. psys->clmd->clothObject->edges always points to correct memory
Chao Li