OK I should have noticed the OP edition (unfortunately mails don't show them…). Actually, it happens reliably (under with rectangular selection, or possibly any kind of non-stream selection. There's invalid memory manipulation inside Scintilla's `SCI_MOVESELECTEDLINESDOWN`/`UP`.