This crash occurs due to iterator invaildation after calling std::set::erase().
See the attached patch for a correct way to delete elements from a std::set while iterating over it.
If you apply this fix the TSP will not crash anymore but the transfer will not work correctly as it did in Activa TSP 1.6 because the same code deletes the wrong channel (the device is in the INITIALIZED state).
I my case I had a call from ext1->ext2 and I've tried to transfer the call from ext2 to ext3.
I got:
ext1 - INITIALIZED
ext2 - CONNECTED
and instead of transfering the channel belonging to ext1 it transfers the channel of ext2 which is the closed.
In 1.6 the channel of ext1 was transfered. So If I completly remove this code the transfers are working as expected.
Patch to fix the crash
Thanks for the patch, we will apply in next version.