all-insets-toggle is for text insets (collapsables and charstyles) only. The attached patch skips math insets and thus fixes the crash.
Committing now. Jürgen
Index: src/lyxfunc.C =================================================================== --- src/lyxfunc.C (Revision 17755) +++ src/lyxfunc.C (Arbeitskopie) @@ -1563,8 +1563,9 @@ InsetIterator it = inset_iterator_begin(inset); InsetIterator const end = inset_iterator_end(inset); for (; it != end; ++it) { - if (inset_code == InsetBase::NO_CODE - || inset_code == it->lyxCode()) { + if (!it->asInsetMath() + && (inset_code == InsetBase::NO_CODE + || inset_code == it->lyxCode())) { LCursor tmpcur = cur; tmpcur.pushLeft(*it); it->dispatch(tmpcur, fr);