Plasma version: 5.12.4
KDE Frameworks version: 5.44.0
Qt version: 5.9.4
Distro and kernel version: Fedora 27, all updated, 4.15.15-300.fc27.x86_64

Steps to reproduce:
1. Open "Configure Desktop" wallpaper configuration
2. Select a different layout
3. Click either apply button
4. plasmashell always crashes. It may not crash on the first try, in which case repeat steps 2 and 3 until it does.

Backtrace:

Breakpoint 2 at 0x7ffff0194e60
Breakpoint 3 at 0x7ffff0194eb0
Continuing.
[New Thread 0x7fffd9f0b700 (LWP 4677)]
[New Thread 0x7fffd3d72700 (LWP 4678)]
[New Thread 0x7fffd232d700 (LWP 4679)]
[New Thread 0x7fffcbdc6700 (LWP 4680)]
[New Thread 0x7fffc9d66700 (LWP 4681)]
[New Thread 0x7fff36247700 (LWP 4682)]
[New Thread 0x7fff21538700 (LWP 4683)]
[New Thread 0x7fff0e6e1700 (LWP 4685)]
[New Thread 0x7fff07fff700 (LWP 4686)]
[Thread 0x7fff07fff700 (LWP 4686) exited]
[New Thread 0x7fff07fff700 (LWP 4687)]
[New Thread 0x7fff061ee700 (LWP 4688)]
[Thread 0x7fff061ee700 (LWP 4688) exited]
[Thread 0x7fff0e6e1700 (LWP 4685) exited]

Thread 1 "plasmashell" received signal SIGSEGV, Segmentation fault.
0x00007fffef86a8fd in malloc_consolidate () from /lib64/libc.so.6

Thread 11 (Thread 0x7fff07fff700 (LWP 4687)):
#0  0x00007fffef8d7c6b in poll () from /lib64/libc.so.6
#1  0x00007fffe7b9ee99 in g_main_context_iterate.isra () from /lib64/libglib-2.0.so.0
#2  0x00007fffe7b9efac in g_main_context_iteration () from /lib64/libglib-2.0.so.0
#3  0x00007ffff072dc2f in QEventDispatcherGlib::processEvents (this=0x7fff000050b0, flags=...) at kernel/qeventdispatcher_glib.cpp:423
#4  0x00007ffff06db96a in QEventLoop::exec (this=this@entry=0x7fff07ffec40, flags=..., flags@entry=...) at kernel/qeventloop.cpp:212
#5  0x00007ffff052c8ca in QThread::exec (this=this@entry=0x555558eaddf0) at thread/qthread.cpp:515
#6  0x00007ffff47a2245 in QQmlThreadPrivate::run (this=0x555558eaddf0) at qml/ftw/qqmlthread.cpp:147
#7  0x00007ffff0530de2 in QThreadPrivate::start (arg=0x555558eaddf0) at thread/qthread_unix.cpp:368
#8  0x00007fffeec3150b in start_thread () from /lib64/libpthread.so.0
#9  0x00007fffef8e216f in clone () from /lib64/libc.so.6

Thread 8 (Thread 0x7fff21538700 (LWP 4683)):
#0  0x00007fffef8d7c6b in poll () from /lib64/libc.so.6
#1  0x00007fffe7b9ee99 in g_main_context_iterate.isra () from /lib64/libglib-2.0.so.0
#2  0x00007fffe7b9efac in g_main_context_iteration () from /lib64/libglib-2.0.so.0
#3  0x00007ffff072dc2f in QEventDispatcherGlib::processEvents (this=0x7fff1c000b20, flags=...) at kernel/qeventdispatcher_glib.cpp:423
#4  0x00007ffff06db96a in QEventLoop::exec (this=this@entry=0x7fff21537c20, flags=..., flags@entry=...) at kernel/qeventloop.cpp:212
#5  0x00007ffff052c8ca in QThread::exec (this=<optimized out>) at thread/qthread.cpp:515
#6  0x00007fff23eb55a7 in KCupsConnection::run() () from /lib64/libkcupslib.so
#7  0x00007ffff0530de2 in QThreadPrivate::start (arg=0x55555874cc50) at thread/qthread_unix.cpp:368
#8  0x00007fffeec3150b in start_thread () from /lib64/libpthread.so.0
#9  0x00007fffef8e216f in clone () from /lib64/libc.so.6

Thread 7 (Thread 0x7fff36247700 (LWP 4682)):
#0  0x00007fffef8d7c6b in poll () from /lib64/libc.so.6
#1  0x00007fffe7b9ee99 in g_main_context_iterate.isra () from /lib64/libglib-2.0.so.0
#2  0x00007fffe7b9efac in g_main_context_iteration () from /lib64/libglib-2.0.so.0
#3  0x00007ffff072dc2f in QEventDispatcherGlib::processEvents (this=0x7fff30000b20, flags=...) at kernel/qeventdispatcher_glib.cpp:423
#4  0x00007ffff06db96a in QEventLoop::exec (this=this@entry=0x7fff36246bf0, flags=..., flags@entry=...) at kernel/qeventloop.cpp:212
#5  0x00007ffff052c8ca in QThread::exec (this=this@entry=0x555557057870) at thread/qthread.cpp:515
#6  0x00007ffff5341116 in QQuickPixmapReader::run (this=0x555557057870) at util/qquickpixmapcache.cpp:868
#7  0x00007ffff0530de2 in QThreadPrivate::start (arg=0x555557057870) at thread/qthread_unix.cpp:368
#8  0x00007fffeec3150b in start_thread () from /lib64/libpthread.so.0
#9  0x00007fffef8e216f in clone () from /lib64/libc.so.6

Thread 6 (Thread 0x7fffc9d66700 (LWP 4681)):
#0  0x00007fffeec3782d in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0
#1  0x00007ffff7668604 in QTWTF::TCMalloc_PageHeap::scavengerThread() () from /lib64/libQt5Script.so.5
#2  0x00007ffff7668649 in QTWTF::TCMalloc_PageHeap::runScavengerThread(void*) () from /lib64/libQt5Script.so.5
#3  0x00007fffeec3150b in start_thread () from /lib64/libpthread.so.0
#4  0x00007fffef8e216f in clone () from /lib64/libc.so.6

Thread 5 (Thread 0x7fffcbdc6700 (LWP 4680)):
#0  0x00007fffef8d7c6b in poll () from /lib64/libc.so.6
#1  0x00007fffe7b9ee99 in g_main_context_iterate.isra () from /lib64/libglib-2.0.so.0
#2  0x00007fffe7b9efac in g_main_context_iteration () from /lib64/libglib-2.0.so.0
#3  0x00007ffff072dc2f in QEventDispatcherGlib::processEvents (this=0x7fffc0000b20, flags=...) at kernel/qeventdispatcher_glib.cpp:423
#4  0x00007ffff06db96a in QEventLoop::exec (this=this@entry=0x7fffcbdc5c40, flags=..., flags@entry=...) at kernel/qeventloop.cpp:212
#5  0x00007ffff052c8ca in QThread::exec (this=this@entry=0x5555559ad860) at thread/qthread.cpp:515
#6  0x00007ffff47a2245 in QQmlThreadPrivate::run (this=0x5555559ad860) at qml/ftw/qqmlthread.cpp:147
#7  0x00007ffff0530de2 in QThreadPrivate::start (arg=0x5555559ad860) at thread/qthread_unix.cpp:368
#8  0x00007fffeec3150b in start_thread () from /lib64/libpthread.so.0
#9  0x00007fffef8e216f in clone () from /lib64/libc.so.6

Thread 4 (Thread 0x7fffd232d700 (LWP 4679)):
#0  0x00007fffef8d7c6b in poll () from /lib64/libc.so.6
#1  0x00007fffe7b9ee99 in g_main_context_iterate.isra () from /lib64/libglib-2.0.so.0
#2  0x00007fffe7b9efac in g_main_context_iteration () from /lib64/libglib-2.0.so.0
#3  0x00007ffff072dc2f in QEventDispatcherGlib::processEvents (this=0x7fffc4000b20, flags=...) at kernel/qeventdispatcher_glib.cpp:423
#4  0x00007ffff06db96a in QEventLoop::exec (this=this@entry=0x7fffd232cc40, flags=..., flags@entry=...) at kernel/qeventloop.cpp:212
#5  0x00007ffff052c8ca in QThread::exec (this=this@entry=0x5555558a8060) at thread/qthread.cpp:515
#6  0x00007ffff47a2245 in QQmlThreadPrivate::run (this=0x5555558a8060) at qml/ftw/qqmlthread.cpp:147
#7  0x00007ffff0530de2 in QThreadPrivate::start (arg=0x5555558a8060) at thread/qthread_unix.cpp:368
#8  0x00007fffeec3150b in start_thread () from /lib64/libpthread.so.0
#9  0x00007fffef8e216f in clone () from /lib64/libc.so.6

Thread 3 (Thread 0x7fffd3d72700 (LWP 4678)):
#0  0x00007fffef8d7c6b in poll () from /lib64/libc.so.6
#1  0x00007fffe7b9ee99 in g_main_context_iterate.isra () from /lib64/libglib-2.0.so.0
#2  0x00007fffe7b9efac in g_main_context_iteration () from /lib64/libglib-2.0.so.0
#3  0x00007ffff072dc2f in QEventDispatcherGlib::processEvents (this=0x7fffcc000b20, flags=...) at kernel/qeventdispatcher_glib.cpp:423
#4  0x00007ffff06db96a in QEventLoop::exec (this=this@entry=0x7fffd3d71c20, flags=..., flags@entry=...) at kernel/qeventloop.cpp:212
#5  0x00007ffff052c8ca in QThread::exec (this=this@entry=0x7ffff0db9060 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder>) at thread/qthread.cpp:515
#6  0x00007ffff0b45449 in QDBusConnectionManager::run (this=0x7ffff0db9060 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder>)
    at qdbusconnection.cpp:178
#7  0x00007ffff0530de2 in QThreadPrivate::start (arg=0x7ffff0db9060 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder>) at thread/qthread_unix.cpp:368
#8  0x00007fffeec3150b in start_thread () from /lib64/libpthread.so.0
#9  0x00007fffef8e216f in clone () from /lib64/libc.so.6

Thread 2 (Thread 0x7fffd9f0b700 (LWP 4677)):
#0  0x00007fffef8d7c6b in poll () from /lib64/libc.so.6
#1  0x00007ffff5f4ffe7 in _xcb_conn_wait () from /lib64/libxcb.so.1
#2  0x00007ffff5f51dda in xcb_wait_for_event () from /lib64/libxcb.so.1
#3  0x00007fffdbc59bf9 in QXcbEventReader::run (this=0x55555582b0e0) at qxcbconnection.cpp:1335
#4  0x00007ffff0530de2 in QThreadPrivate::start (arg=0x55555582b0e0) at thread/qthread_unix.cpp:368
#5  0x00007fffeec3150b in start_thread () from /lib64/libpthread.so.0
#6  0x00007fffef8e216f in clone () from /lib64/libc.so.6

Thread 1 (Thread 0x7ffff7f9e940 (LWP 4673)):
#0  0x00007fffef86a8fd in malloc_consolidate () from /lib64/libc.so.6
#1  0x00007fffef86d53d in _int_malloc () from /lib64/libc.so.6
#2  0x00007fffef86f02d in malloc () from /lib64/libc.so.6
#3  0x00007ffff05317a2 in QArrayData::allocate (objectSize=objectSize@entry=2, alignment=alignment@entry=8, capacity=capacity@entry=21846, options=..., 
    options@entry=...) at tools/qarraydata.cpp:118
#4  0x00007ffff059d806 in QTypedArrayData<unsigned short>::allocate (options=..., capacity=21846) at ../../include/QtCore/../../src/corelib/tools/qarraydata.h:223
#5  QString::QString (this=0x7fffffffd2b0, unicode=0x555555aa4f90, size=21845) at tools/qstring.cpp:1571
#6  0x00007ffff06b6c57 in QJsonPrivate::String::toString (this=<optimized out>) at json/qjson_p.h:391
#7  QJsonPrivate::String::operator>= (str=..., this=<optimized out>) at json/qjson_p.h:374
#8  QJsonPrivate::Entry::operator>= (key=..., this=<optimized out>) at json/qjson_p.h:743
#9  QJsonPrivate::Object::indexOf (this=0x555555aa4f88, key=..., exists=exists@entry=0x7fffffffd307) at json/qjson.cpp:191
#10 0x00007ffff06b9843 in QJsonObject::value (this=0x7fffffffd4b0, key=...) at json/qjsonobject.cpp:371
#11 0x00007ffff2925f1a in KPluginMetaData::readStringList(QJsonObject const&, QString const&) () from /lib64/libKF5CoreAddons.so.5
#12 0x00007ffff7994665 in PlasmaQuick::AppletQuickItemPrivate::preloadWeight (this=0x55555590c850)
    at /usr/src/debug/kf5-plasma-5.44.0-1.fc27.x86_64/src/plasmaquick/appletquickitem.cpp:94
#13 0x00007ffff7994b82 in PlasmaQuick::AppletQuickItem::~AppletQuickItem (this=0x555555a5c7a0, __in_chrg=<optimized out>)
    at /usr/src/debug/kf5-plasma-5.44.0-1.fc27.x86_64/src/plasmaquick/appletquickitem.cpp:509
#14 0x00007fffcbdeb07b in ContainmentInterface::~ContainmentInterface (this=0x555555a5c7a0, __in_chrg=<optimized out>)
    at /usr/src/debug/kf5-plasma-5.44.0-1.fc27.x86_64/src/scriptengines/qml/plasmoid/containmentinterface.h:51
#15 ContainmentInterface::~ContainmentInterface (this=0x555555a5c7a0, __in_chrg=<optimized out>)
    at /usr/src/debug/kf5-plasma-5.44.0-1.fc27.x86_64/src/scriptengines/qml/plasmoid/containmentinterface.h:51
#16 0x00007ffff070bcc8 in QObjectPrivate::deleteChildren (this=this@entry=0x555555a75d30) at kernel/qobject.cpp:1992
#17 0x00007ffff070cba2 in QObject::~QObject (this=<optimized out>, __in_chrg=<optimized out>) at kernel/qobject.cpp:1022
#18 0x00007ffff5aab339 in Plasma::Containment::~Containment (this=0x555555a64110, __in_chrg=<optimized out>)
    at /usr/src/debug/kf5-plasma-5.44.0-1.fc27.x86_64/src/plasma/containment.cpp:95
#19 0x00007ffff0706288 in QObject::event (this=0x555555a64110, e=<optimized out>) at kernel/qobject.cpp:1237
#20 0x00007ffff180f92c in QApplicationPrivate::notify_helper (this=this@entry=0x555555813b70, receiver=receiver@entry=0x555555a64110, e=e@entry=0x555558f007b0)
    at kernel/qapplication.cpp:3722
#21 0x00007ffff1817174 in QApplication::notify (this=0x7fffffffdce0, receiver=0x555555a64110, e=0x555558f007b0) at kernel/qapplication.cpp:3481
#22 0x00007ffff06dcbe7 in QCoreApplication::notifyInternal2 (receiver=0x555555a64110, event=event@entry=0x555558f007b0) at kernel/qcoreapplication.cpp:1016
#23 0x00007ffff06df36b in QCoreApplication::sendEvent (event=0x555558f007b0, receiver=<optimized out>) at kernel/qcoreapplication.h:233
#24 QCoreApplicationPrivate::sendPostedEvents (receiver=receiver@entry=0x0, event_type=event_type@entry=0, data=0x555555809090) at kernel/qcoreapplication.cpp:1676
#25 0x00007ffff06df888 in QCoreApplication::sendPostedEvents (receiver=receiver@entry=0x0, event_type=event_type@entry=0) at kernel/qcoreapplication.cpp:1530
#26 0x00007ffff072de43 in postEventSourceDispatch (s=0x555555856de0) at kernel/qeventdispatcher_glib.cpp:276
#27 0x00007fffe7b9eb77 in g_main_context_dispatch () from /lib64/libglib-2.0.so.0
#28 0x00007fffe7b9ef20 in g_main_context_iterate.isra () from /lib64/libglib-2.0.so.0
#29 0x00007fffe7b9efac in g_main_context_iteration () from /lib64/libglib-2.0.so.0
#30 0x00007ffff072dc2f in QEventDispatcherGlib::processEvents (this=0x555555854150, flags=...) at kernel/qeventdispatcher_glib.cpp:423
#31 0x00007ffff06db96a in QEventLoop::exec (this=this@entry=0x7fffffffdbe0, flags=..., flags@entry=...) at kernel/qeventloop.cpp:212
#32 0x00007ffff06e4094 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1289
#33 0x0000555555572d5a in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/plasma-workspace-5.12.4-1.fc27.x86_64/shell/main.cpp:166