With module-bluetooth-policy, a A2DP/HSP headset plugged in, and all other cards disabled, if I create a stream that causes a profile switch (PULSE_PROP=media.role=phone parec > /dev/null), I see the following segfault:

I: [lt-pulseaudio] source-output.c: Freeing output 2 "Record Stream"
E: [lt-pulseaudio] object.c: Assertion 'pa_object_refcnt(o) > 0' failed at ../../src/pulsecore/object.c:58, function pa_object_unref(). Aborting.

Thread 1 "lt-pulseaudio" received signal SIGABRT, Aborted.
0x00007ffff463c6f5 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
54	  return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);
Missing separate debuginfos, use: dnf debuginfo-install avahi-libs-0.6.32-4.fc24.x86_64 gsm-1.0.13-14.fc24.x86_64 jack-audio-connection-kit-1.9.10-5.fc24.x86_64 libXi-1.7.6-2.fc24.x86_64 libXtst-1.2.2-6.fc24.x86_64 libasyncns-0.8-10.fc24.x86_64 libgcc-6.1.1-3.fc24.x86_64 libgomp-6.1.1-3.fc24.x86_64 libsndfile-1.0.25-20.fc24.x86_64 libstdc++-6.1.1-3.fc24.x86_64 libtdb-1.3.9-1.fc24.x86_64 libtool-ltdl-2.4.6-11.fc24.x86_64 sbc-1.3-4.fc24.x86_64 soxr-0.1.2-2.fc24.x86_64 speexdsp-1.2-0.9.rc3.fc24.x86_64 tcp_wrappers-libs-7.6-83.fc24.x86_64
(gdb) bt
#0  0x00007ffff463c6f5 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1  0x00007ffff463e2fa in __GI_abort () at abort.c:89
#2  0x00007ffff7b610f2 in pa_object_unref (o=<optimized out>) at ../../src/pulsecore/object.c:61
#3  0x00007fffe6734dce in pa_source_output_unref (o=0x0) at ../../src/pulsecore/source-output.h:215
#4  record_stream_unlink (s=0x76ed30) at ../../src/pulsecore/protocol-native.c:338
#5  0x00007fffe674031a in command_delete_stream (pd=<optimized out>, command=6, tag=21, t=0x62dce0, 
    userdata=<optimized out>) at ../../src/pulsecore/protocol-native.c:2144
#6  0x00007ffff6d9669f in pa_pdispatch_run (pd=0x7a42e0, packet=packet@entry=0x745c00, 
    ancil_data=ancil_data@entry=0x7c89e8, userdata=userdata@entry=0x779320) at ../../src/pulsecore/pdispatch.c:346
#7  0x00007fffe6741685 in pstream_packet_callback (p=0x7c8750, packet=0x745c00, ancil_data=0x7c89e8, userdata=0x779320)
    at ../../src/pulsecore/protocol-native.c:4941
#8  0x00007ffff6d98fe7 in do_read (p=p@entry=0x7c8750, re=re@entry=0x7c8918) at ../../src/pulsecore/pstream.c:1012
#9  0x00007ffff6d9bc0b in do_pstream_read_write (p=0x7c8750) at ../../src/pulsecore/pstream.c:248
#10 0x00007ffff6d9bfa9 in srb_callback (srb=<optimized out>, userdata=0x7c8750) at ../../src/pulsecore/pstream.c:287
#11 0x00007ffff6d9c80a in srbchannel_rwloop (sr=0x7903d0) at ../../src/pulsecore/srbchannel.c:190
#12 0x00007ffff790716c in dispatch_pollfds (m=0x618290) at ../../src/pulse/mainloop.c:655
#13 pa_mainloop_dispatch (m=m@entry=0x618290) at ../../src/pulse/mainloop.c:898
#14 0x00007ffff790756c in pa_mainloop_iterate (m=0x618290, block=<optimized out>, retval=0x7fffffffda08)
    at ../../src/pulse/mainloop.c:929
#15 0x00007ffff7907610 in pa_mainloop_run (m=m@entry=0x618290, retval=retval@entry=0x7fffffffda08)
    at ../../src/pulse/mainloop.c:944
#16 0x0000000000406eac in main (argc=<optimized out>, argv=<optimized out>) at ../../src/daemon/main.c:1140