This was originally reported on Fedora 28: https://bugzilla.redhat.com/show_bug.cgi?id=1594596 .

Description of problem:
pulseaudio crashes with SIGABRT when trying to switch Bluetooth headset profile.

Version-Release number of selected component (if applicable):
$ rpm -qa blue\* pulse\* |sort
blueberry-1.2.2-1.fc28.noarch
bluez-5.50-1.fc28.x86_64
bluez-cups-5.50-1.fc28.x86_64
bluez-hcidump-2.5-11.fc28.x86_64
bluez-hid2hci-5.50-1.fc28.x86_64
bluez-libs-5.50-1.fc28.x86_64
bluez-obexd-5.50-1.fc28.x86_64
bluez-tools-0.2.0-0.7.git20170912.7cb788c.fc28.x86_64
pulseaudio-12.0-1.fc28.x86_64
pulseaudio-libs-12.0-1.fc28.i686
pulseaudio-libs-12.0-1.fc28.x86_64
pulseaudio-libs-glib2-12.0-1.fc28.x86_64
pulseaudio-module-bluetooth-12.0-1.fc28.x86_64
pulseaudio-module-x11-12.0-1.fc28.x86_64
pulseaudio-utils-12.0-1.fc28.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Connect a BT headset (Jabra Evolve 65)
2. pactl set-card-profile bluez_card.aa_bb_cc_xx_yy_zz a2dp_sink

Actual results:
Connection failure: Connection terminated
(pulseaudio crashes)

Expected results:
New sink with A2DP profile becomes available.

Additional info:
gdb backtrace:
$ gdb pulseaudio /var/spool/abrt/ccpp-2018-06-24-23:42:32.635655-16789/coredump
GNU gdb (GDB) Fedora 8.1-15.fc28
...
Core was generated by `/usr/bin/pulseaudio --daemonize=no'.
Program terminated with signal SIGABRT, Aborted.
#0  0x00007f5a6fddff2b in raise () from /lib64/libc.so.6
[Current thread is 1 (Thread 0x7f5a738b4980 (LWP 16789))]
(gdb) where
#0  0x00007f5a6fddff2b in raise () from /lib64/libc.so.6
#1  0x00007f5a6fdca561 in abort () from /lib64/libc.so.6
#2  0x00007f5a64022765 in start_thread (u=u@entry=0x5634fe461120) at modules/bluetooth/module-bluez5-device.c:1731
#3  0x00007f5a64025583 in set_profile_cb (c=<optimized out>, new_profile=0x5634fe579d20)
    at modules/bluetooth/module-bluez5-device.c:2075
#4  0x00007f5a7344216e in pa_card_set_profile (c=c@entry=0x5634fe4be810, profile=profile@entry=0x5634fe579d20, 
    save=save@entry=true) at pulsecore/card.c:318
#5  0x00007f5a6884f62d in command_set_card_profile (pd=<optimized out>, command=<optimized out>, tag=2, 
    t=<optimized out>, userdata=<optimized out>) at pulsecore/protocol-native.c:4728
#6  0x00007f5a72675203 in pa_pdispatch_run (pd=0x5634fe57ec90, packet=packet@entry=0x5634fe5295f0, 
    ancil_data=ancil_data@entry=0x5634fe45ef18, userdata=userdata@entry=0x5634fe4ba430) at pulsecore/pdispatch.c:346
#7  0x00007f5a68857ee9 in pstream_packet_callback (p=0x5634fe45ec80, packet=0x5634fe5295f0, ancil_data=0x5634fe45ef18, 
    userdata=0x5634fe4ba430) at pulsecore/protocol-native.c:4951
#8  0x00007f5a72677bfd in do_read (p=p@entry=0x5634fe45ec80, re=re@entry=0x5634fe45ee48) at pulsecore/pstream.c:1012
#9  0x00007f5a7267aa4b in do_pstream_read_write (p=0x5634fe45ec80) at pulsecore/pstream.c:248
#10 0x00007f5a7267adfd in srb_callback (srb=0x5634fe49ad90, userdata=0x5634fe45ec80) at pulsecore/pstream.c:287
#11 0x00007f5a7267b68a in srbchannel_rwloop (sr=0x5634fe49ad90) at pulsecore/srbchannel.c:190
#12 0x00007f5a731ed798 in dispatch_pollfds (m=0x5634fe366970) at pulse/mainloop.c:140
#13 pa_mainloop_dispatch (m=m@entry=0x5634fe366970) at pulse/mainloop.c:898
#14 0x00007f5a731eda70 in pa_mainloop_iterate (m=0x5634fe366970, block=<optimized out>, retval=0x7ffcb566f698)
    at pulse/mainloop.c:929
#15 0x00007f5a731edb10 in pa_mainloop_run (m=0x5634fe366970, retval=0x7ffcb566f698) at pulse/mainloop.c:945
#16 0x00005634fe0e006f in main (argc=<optimized out>, argv=<optimized out>) at daemon/main.c:1144
(gdb)