I may have been able to obtain a backtrace (using windebug):
# ChildEBP RetAddr Args to Child
00 0607e87c 771d98cb 77114c88 933a9ca3 01b70000 ntdll!RtlpValidateHeapEntry+0x63ad4
01 0607e8dc 7712dd3e 015bfd78 933a9dcf 015bfd70 ntdll!RtlDebugFreeHeap+0xc6 (FPO: [Non-Fpo])
02 0607e9b0 77176ceb 015bfd70 015bfd78 015bfd78 ntdll!RtlpFreeHeap+0xce (FPO: [Non-Fpo])
03 0607ea0c 7712dc16 00000000 00000000 00000000 ntdll!RtlpFreeHeapInternal+0x783 (FPO: [Non-Fpo])
04 0607ea2c 754d7409 01b70000 00000000 015bfd78 ntdll!RtlFreeHeap+0x46 (FPO: [Non-Fpo])
05 0607ea78 61af8e1a 015bfd78 0000008b 0000008b msvcrt!free+0x69 (FPO: [Non-Fpo])
06 0607eac8 61ae8470 03be64f0 03addae8 0000000a libssh!ssh_threads_get_pthread+0x291a
07 0607eb08 61ae3c8c 03befbe0 03be64f0 0607eb3c libssh!ssh_pki_copy_cert_to_privkey+0x250
08 0607eb48 61ae2d84 03b1a620 00000015 03be65b0 libssh!ssh_bind_options_parse_config+0x215c
09 0607eb88 61ae3407 03b1a620 00000015 61b1b180 libssh!ssh_bind_options_parse_config+0x1254
0a 0607ebf8 61ae394f 03bc5070 00000010 03b1a620 libssh!ssh_bind_options_parse_config+0x18d7
0b 0607ec38 61ac55b7 03bc4ec0 0607ecb0 000001c0 libssh!ssh_bind_options_parse_config+0x1e1f
0c 00000000 00000000 00000000 00000000 00000000 libssh!ssh_buffer_add_data+0xe7
Unfortunately, this looks like a double free in libssh to me.