[reproducible] Crash to Desktop when assigning 3 envoys to Toronto

[Heinage]

Patch Version: 1.0.0.26 (221715)

I've played through turn 518 a few times to narrow down what is causing the crash to desktop.
Here are the steps to reproduce:

1. Move Ranger down to encampment
2. Use Bomber to attack Scythian Cavalry on the Southwest border
3. Move Field Cannon into city and give it the tier 2 promotion
4. Place all 3 available envoys in Toronto (this causes it to crash for me)

If you assign just 1 envoy to Toronto and 2 to Kabul, it doesn't crash. In fact, doing anything else is fine I believe.