QSharedPointer is partially thread-safe, partially reentrant

After tracing real strange bugs in a huge application, I traced it back to the sharedpointer.
Now that I know what happens I extracted a tiny project which reproduces the effect.

I'm really confused now as this issue is in 4.8 (which I use), but also reproduces with 5.2 ...

The "non-thread-safe-window" seems to be really short, even in the heavy sample-project(attached) it requires some loops until it is hit.

I suspect that it is the code of "internalCopy" (in sharedpointer-impl), which access data before doing the ref() call.