Update: it turns out the renderer process is crashing after all. I found http://www.chromium.org/developers/how-tos/debugging#TOC-Attaching-to-the-renderer, which taught me how to attach to the process before it got the access violation, and then got a stack trace in Visual Studio:
chromiumcontent.dll!base::Thread::message_loop_proxy() Line 150 C++
chromiumcontent.dll!content::ChildProcess::io_message_loop_proxy() Line 47 C++
chromiumcontent.dll!content::VideoCaptureImplManager::UnrefDevice(int id) Line 170 C++
chromiumcontent.dll!base::internal::Invoker<2,base::internal::BindState<base::internal::RunnableAdapter<void (__thiscall content::AppCacheResponseIO::*)(int)>,void __cdecl(content::AppCacheResponseIO *,int),void __cdecl(base::WeakPtr<content::AppCacheResponseIO>,int)>,void __cdecl(content::AppCacheResponseIO *,int)>::Run(base::internal::BindStateBase * base) Line 1253 C++
chromiumcontent.dll!content::VideoCapturerDelegate::~VideoCapturerDelegate() Line 59 C++
[External Code]
chromiumcontent.dll!scoped_refptr<net::IOBuffer>::~scoped_refptr<net::IOBuffer>() Line 295 C++
chromiumcontent.dll!base::internal::BindState<base::internal::RunnableAdapter<void (__cdecl*)(base::TaskRunner *,base::Callback<void __cdecl(void)> const &)>,void __cdecl(base::TaskRunner *,base::Callback<void __cdecl(void)> const &),void __cdecl(scoped_refptr<base::MessageLoopProxy>,base::Callback<void __cdecl(void)>)>::~BindState<base::internal::RunnableAdapter<void (__cdecl*)(base::TaskRunner *,base::Callback<void __cdecl(void)> const &)>,void __cdecl(base::TaskRunner *,base::Callback<void __cdecl(void)> const &),void __cdecl(scoped_refptr<base::MessageLoopProxy>,base::Callback<void __cdecl(void)>)>() Line 2591 C++
[External Code]
chromiumcontent.dll!scoped_refptr<net::IOBuffer>::~scoped_refptr<net::IOBuffer>() Line 295 C++
chromiumcontent.dll!content::VideoCaptureImpl::OnDeviceSupportedFormatsEnumerated(const std::vector<media::VideoCaptureFormat,std::allocator<media::VideoCaptureFormat> > & supported_formats) Line 358 C++
chromiumcontent.dll!content::VideoCaptureMessageFilter::OnDeviceSupportedFormatsEnumerated(int device_id, const std::vector<media::VideoCaptureFormat,std::allocator<media::VideoCaptureFormat> > & supported_formats) Line 200 C++
chromiumcontent.dll!VideoCaptureMsg_DeviceFormatsInUseReceived::Dispatch<content::VideoCaptureMessageFilter,content::VideoCaptureMessageFilter,void,void (__thiscall content::VideoCaptureMessageFilter::*)(int,std::vector<media::VideoCaptureFormat,std::allocator<media::VideoCaptureFormat> > const &)>(const IPC::Message * msg, content::VideoCaptureMessageFilter * obj, content::VideoCaptureMessageFilter * sender, void * parameter, void (int, const std::vector<media::VideoCaptureFormat,std::allocator<media::VideoCaptureFormat> > &) * func) Line 77 C++
chromiumcontent.dll!content::VideoCaptureMessageFilter::OnMessageReceived(const IPC::Message & message) Line 68 C++
chromiumcontent.dll!IPC::`anonymous namespace'::TryFiltersImpl(std::vector<IPC::MessageFilter *,std::allocator<IPC::MessageFilter *> > & filters, const IPC::Message & message) Line 18 C++
chromiumcontent.dll!IPC::MessageFilterRouter::TryFilters(const IPC::Message & message) Line 76 C++
chromiumcontent.dll!IPC::ChannelProxy::Context::TryFilters(const IPC::Message & message) Line 67 C++
chromiumcontent.dll!IPC::SyncChannel::SyncContext::OnMessageReceived(const IPC::Message & msg) Line 331 C++
chromiumcontent.dll!IPC::internal::ChannelReader::DispatchInputData(const char * input_data, int input_data_len) Line 98 C++
chromiumcontent.dll!IPC::internal::ChannelReader::AsyncReadComplete(int bytes_read) Line 39 C++
chromiumcontent.dll!IPC::ChannelWin::OnIOCompleted(base::MessagePumpForIO::IOContext * context, unsigned long bytes_transfered, unsigned long error) Line 513 C++
chromiumcontent.dll!base::MessagePumpForIO::DoRunLoop() Line 483 C++
chromiumcontent.dll!base::MessagePumpWin::RunWithDispatcher(base::MessagePump::Delegate * delegate, base::MessagePumpDispatcher * dispatcher) Line 51 C++
chromiumcontent.dll!base::MessagePumpWin::Run(base::MessagePump::Delegate * delegate) Line 34 C++
chromiumcontent.dll!base::MessageLoop::RunHandler() Line 415 C++
chromiumcontent.dll!base::RunLoop::Run() Line 55 C++
chromiumcontent.dll!base::MessageLoop::Run() Line 309 C++
chromiumcontent.dll!base::Thread::Run(base::MessageLoop * message_loop) Line 175 C++
chromiumcontent.dll!base::Thread::ThreadMain() Line 232 C++
chromiumcontent.dll!base::`anonymous namespace'::ThreadFunc(void * params) Line 80 C++
[External Code]
[Frames below may be incorrect and/or missing, no symbols loaded for kernel32.dll]
Looks like a bug in Chromium. I’ll post a bug there.