AV when using rules with a project file

[anoy.]

With some code files I get an access violation when I use a rule (--rule or --rule-file) regardless of the regex. This only happens when running on a project.

This can be broken down to the following call:
cppcheck.exe --enable=warning --library=qt.cfg --exception-handling --rule=".+" --project=SomePrj.vcxproj

Unfortunately I can't give a complete example, because surprisingly it works again as soon as I extract the project from our SCM. So maybe its caused by some implicit includes.

One of the files is part of KDSoap: converter_clientstub.cpp

Internal error: Access violation (instruction: 0x00007FFACAFEB647) reading from 0x0000000000000048
0. 0x7FFACAFEB647 in CheckNullPointer::isPointerDeRef
1. 0x7FFACB002ECD in Library::isFunctionConst
2. 0x7FFACB002234 in Library::isFunctionConst
3. 0x7FFACB001DD4 in Library::isFunctionConst
4. 0x7FFACAFAA14E in Token::addValue
5. 0x7FFACAFA8C95 in ErrorLogger::ErrorMessage::verboseMessage
6. 0x7FFACAFA900D in ErrorLogger::ErrorMessage::verboseMessage
7. 0x7FFACAFA70FB in CheckSizeof::sizeofVoid
8. 0x7FFACAFD2D12 in TemplateSimplifier::simplifyTemplateInstantiations
9. 0x7FFACB01EAC5 in Function::getArgumentVar
10. 0x7FFACB01DF7F in Library::returnValue
11. 0x7FFACB01DDF1 in Library::returnValue
12. 0x7FFACB01DD6F in Library::returnValue
13. 0x7FFACB024C4F in ValueFlow::Value::Value
14. 0x7FFACB031AA5 in Function::isSafe
15. 0x7FFACB030932 in Tokenizer::setPodTypes
16. 0x7FFACB18C3B7 in Tokenizer::simplifyTokenList2
17. 0x7FFACB08C191 in CppCheck::version
18. 0x7FFACB131895 in CppCheck::check
19. 0x7FF6F64C622C in CppCheck::check
20. 0x7FF6F64CEF6A in CppCheck::check
21. 0x7FF6F64C5C1B in CppCheck::check
22. 0x7FF6F64C10BC in CppCheck::check
23. 0x7FF6F64C4AA4 in CppCheck::check
24. 0x7FFB23097BD4 in BaseThreadInitThunk
25. 0x7FFB2500CE51 in RtlUserThreadStart
Please report this to the cppcheck developers!

The other AV I've got twice, but is caused by the same call but other projects:

Internal error: Access violation (instruction: 0x00007FFACB01C88B) reading from 0x0000000000000048
0. 0x7FFACB01C88B in Token::Token
1. 0x7FFACB01BD8A in Scope::isLocal
2. 0x7FFACAFA760B in CheckSizeof::sizeofVoid
3. 0x7FFACAFD2D12 in TemplateSimplifier::simplifyTemplateInstantiations
4. 0x7FFACB01C9F8 in Token::Token
5. 0x7FFACB01B457 in Token::getValueGE
6. 0x7FFACAF8F877 in VarInfo::VarInfo
7. 0x7FFACB03094E in Tokenizer::setPodTypes
8. 0x7FFACB18C3B7 in Tokenizer::simplifyTokenList2
9. 0x7FFACB08C191 in CppCheck::version
10. 0x7FFACB131895 in CppCheck::check
11. 0x7FF6F64C622C in CppCheck::check
12. 0x7FF6F64CEF6A in CppCheck::check
13. 0x7FF6F64C5C1B in CppCheck::check
14. 0x7FF6F64C10BC in CppCheck::check
15. 0x7FF6F64C4AA4 in CppCheck::check
16. 0x7FFB23097BD4 in BaseThreadInitThunk
17. 0x7FFB2500CE51 in RtlUserThreadStart
Please report this to the cppcheck developers!

[anoy.]

I could narrow the AV down to the tokenlist, which seems to be 'simple' by default, despite being deprecated (Handling of "simple" rules is deprecated and will be removed in Cppcheck 2.5.). If I set it to 'normal' the check will run without any problems.

I've included an example in the zip attached to my 'multiple thread' issue.

The <tokenlist> option for the rule file does not seem to be documented anywhere (except for the manual-ja.docbook, which I unfortunately cannot read) and cannot be set on the command line.