hosting VST plugins inside M4L causes crash

Hello.

I'm having an issue where Max crashes when I try to host various VST plugins inside of Max for Live. They work fine hosted in a normal Max patch. This happens on Ableton 10.1 and 11 on a 2019 Macbook Pro w Catalina, and on Ableton 10.1 on a 2013 Macbook Pro running Mojave. I'm using Max 8.1, and it happens with several different VST plugins from different developers.

To reproduce, I start a new Ableton session, add a new Max Audio effect, open it in the Max editor, add a vst~ object which points to some plugin, and Max dies shortly after. The exception seems to be either a EXC_BAD_ACCESS (SIGSEGV) or EXC_CRASH (SIGABRT). I've pasted an example stack trace below.

For other reasons, I also reformatted my computer, installed Ableton 10.1 and the problem is still there.

Does anyone have any idea what might be causing this? I can't host these plugins directly in Ableton as I'm working in the Ambisonic domain (16 ch).

Application Specific Information:
abort() called
Max(16035,0x1183afdc0) malloc: Incorrect checksum for freed object 0x7f9be8f0b5c0: probably modified after being freed.
Corrupt value: 0xffc00000ffc00000

Thread 0 Crashed:: CrBrowserMain Dispatch queue: com.apple.main-thread
0 libsystem_kernel.dylib     0x00007fff6a97c33a __pthread_kill + 10
1 libsystem_pthread.dylib     0x00007fff6aa38e60 pthread_kill + 430
2 libsystem_c.dylib     0x00007fff6a903808 abort + 120
3 libsystem_malloc.dylib     0x00007fff6a9f950b malloc_vreport + 548
4 libsystem_malloc.dylib     0x00007fff6aa0ad27 malloc_zone_error + 183
5 libsystem_malloc.dylib     0x00007fff6a9f1081 tiny_free_list_remove_ptr + 690
6 libsystem_malloc.dylib     0x00007fff6a9f0279 tiny_free_no_lock + 1018
7 libsystem_malloc.dylib     0x00007fff6a9efd8b free_tiny + 459
8 com.apple.CoreFoundation     0x00007fff306cad06 -[__NSArrayM dealloc] + 309
9 com.apple.CoreFoundation     0x00007fff307cd1a5 __CFBasicHashRemoveValue + 141
10 com.apple.CoreFoundation     0x00007fff306f03f9 CFBasicHashRemoveValue + 2989
11 com.apple.CoreFoundation     0x00007fff30708405 CFDictionaryRemoveValue + 179
12 com.apple.AppKit     0x00007fff2d992ddc -[NSMenuKEUniquer removeItem:] + 72
13 com.apple.AppKit     0x00007fff2d9a89ad -[NSMenu removeItemAtIndex:] + 322
14 com.cycling74.Max     0x000000011035a420 juce::JuceMainMenuHandler::menuBarItemsChanged(juce::MenuBarModel*) + 1216
15 com.cycling74.Max     0x00000001103634bb juce::MenuBarModel::handleAsyncUpdate() + 59
16 com.cycling74.Max     0x000000010fdc8c32 MaxMenuModel::handleAsyncUpdate() + 36
17 com.cycling74.Max     0x000000011024c5bb
and so on...

Thanks,
Daniel