The issue appears to be with how the UIMoreListController improperly retains the child view controllers until after UITabBarController finishes its dealloc, and then when those child view controllers go to dealloc they crash on a now-invalid (unowned?) reference to the UITabBarController as their parent view controller.
This only seems to occur when the UIMoreNavigationController is set as the UITabBarController's _selectedViewController ivar. Unfortunately, it's not easy to detect if that's the case, because the getter for selectedViewController will (contrary to what is said in the header comments) return whichever of the UITabBarController's viewControllers children is shown in the UIMoreNavigationController, NOT the UIMoreNavigationController reference directly.
I was able to workaround this issue by always running
tabBarController.selectedViewController = tabBarController.viewControllers.firstObject;
to switch back to the first tab's (i.e. not under "More") controller immediately before triggering the deallocation of the UITabBarController. (In my case, the UITabBarController is already offscreen at this point, so there's no visual artifact from this last-moment switching.)