RichEditTextDocument crashes when loading RTF file that contains RTL list (bullets/numbering)

[Khiro95]

Describe the bug

Using RichEditTextDocument.LoadFromStream(TextSetOptions, IRandomAccessStream) or RichEditTextDocument.SetText(TextSetOptions, String) throws exception when I attempt to load a RTF file/text which contains a RTL bulleted list and a numbered list.

Exception:

System.AccessViolationException
  HResult=0x80004003
  Message=Attempted to read or write protected memory. This is often an indication that other memory is corrupt.

• When using RichEditTextDocument.LoadFromStream(TextSetOptions, IRandomAccessStream):
  at Microsoft.WinUI.dll!ABI.Microsoft.UI.Xaml.IFrameworkElementOverridesMethods.MeasureOverride(WinRT.IObjectReference _obj, Windows.Foundation.Size availableSize)
• When using RichEditTextDocument.SetText(TextSetOptions, String):
  at Microsoft.WinUI.dll!ABI.Microsoft.UI.Text.ITextDocumentMethods.SetText(WinRT.IObjectReference _obj, Microsoft.UI.Text.TextSetOptions options, string value)

This is a sample RTF block that reproduce the issue:

\pard{\pntext\f2\'B7\tab}{\*\pn\pnlvlblt\pnf2\pnindent0{\pntxtb\'B7}}\rtlpar\fi-360\li720\sa200\sl276\slmult1\qr\f0\rtlch\fs22\lang5121\'c7\'e1\'da\'e4\'d5\'d1 \'c7\'e1\'c3\'e6\'e1\par
{\pntext\f2\'B7\tab}\f0\rtlch\lang5121\'c7\'e1\'da\'e4\'d5\'d1 \'c7\'e1\'cb\'c7\'e4\'ed\par

The \rtlpar control word is what makes the app crash since removing it, or even replacing it with \ltrpar control word, doesn't cause crash.

Steps to reproduce the bug

1. Add a RichEditBox element.

<RichEditBox x:Name="richTB"/>

2. Load a .rtf file that contains RTL list

StorageFile file = await StorageFile.GetFileFromPathAsync(@"C:\test.rtf");
IRandomAccessStream randAccStream = await file.OpenAsync(FileAccessMode.Read);
richTB.Document.LoadFromStream(TextSetOptions.FormatRtf | TextSetOptions.UnicodeBidi, randAccStream);

test.rtf file has the following content (in Arabic):

{\rtf1\fbidis\ansi\deff0\nouicompat{\fonttbl{\f0\fnil\fcharset178 Segoe UI;}{\f1\fnil\fcharset0 Calibri;}{\f2\fnil\fcharset2 Symbol;}}
{\*\generator Riched20 10.0.19041}\viewkind4\uc1 
\pard{\pntext\f2\'B7\tab}{\*\pn\pnlvlblt\pnf2\pnindent0{\pntxtb\'B7}}\rtlpar\fi-360\li720\sa200\sl276\slmult1\qr\f0\rtlch\fs22\lang5121\'c7\'e1\'da\'e4\'d5\'d1 \'c7\'e1\'c3\'e6\'e1\par
{\pntext\f2\'B7\tab}\f0\rtlch\lang5121\'c7\'e1\'da\'e4\'d5\'d1 \'c7\'e1\'cb\'c7\'e4\'ed\par
}

3. Run the app and observe the crash

Expected behavior

I expect RichEditTextDocument to be able to load any valid RTF file/text including those containing RTL lists.

Screenshots

That's what I see when open the sample .rtf file using WordPad:

NuGet package version

WinUI 3 - Windows App SDK 1.6.2: 1.6.241106002

Windows version

Windows 10 (21H2): Build 19044

Additional context

Loading the same file works fine in a WPF app!

[Khiro95]

Update: The issue happens only when the RichEditBox is visible.