See this thread for full discussion.
Currently the Cortex M3/M4 port (maybe others?) does not save the current BASEPRI value when entering a critical section and does not restore it when exiting. If a critical section is entered in vTaskSwitchContext (called from the PendSV handler), the effective BASEPRI will become the PendSV priority upon exit, leaving vTaskSwitchContext open to race conditions.
If portTICK_TYPE_IS_ATOMIC is not set (which it normally ought to be, but I found the port that overlooked it) and runtime statistics are enabled, vTaskSwitchContext's critical section is broken by the tick read's critical section and any interrupt above PendSV's priority can then interrupt it.
Ticket never got closed after the issue was fixed.