In principle, there is a lock used for destination list: https://github.com/kamailio/kamailio/blob/master/src/modules/keepalive/keepa... and when freeing the destination the timer is being stopped, https://github.com/kamailio/kamailio/blob/master/src/modules/keepalive/keepa...
mmm, I wonder why URI seems corrupted, but didn't get to corrupt "owner" in the backtrace.