QAbstractItemModel::index(), documented in
https://doc.qt.io/qt-5/qabstractitemmodel.html#index , is const for a good reason: In a corresponding QItemSelectionModel, there are instances of QItemSelectionRange which use the index() method in their methods. If the QAbstractItemModel::index() method changed the model, this could trigger signals like layoutChanged() to be emitted, which in turn could lead to the deletion of a QItemSelectionRange in the QItemSelectionModel, so of the object we are executing a method of.
Despite QAbstractItemModel::index() being const, QTreeModel::index() calls QTreeModel::executePendingSort() which just const_cast the const away and sort the model, leading to the problems described above.
The const_cast can be found here:
I'll try to create a reproducer for a read-after-free.