The avp search state is set inside pv_get_avp () before pv_core.c:1793, so the static state from core/usr_avp.c:421 is not used.
It looks like a race in the way that the current avp referred from the state is destroyed, so when the search reads ->next, the value is no longer valid. Do you have the sip traffic for this case, was there any other response processed at the same time? Or the transaction timed-out?
You can also check the config and see if/when the avp `lastdst` is deleted and try to see if you get any leads from there.