Access violations where the faulting address is ASCII ("python", "toolset") — string dereferenced as pointer

[harness-lab]

Bug: access violations where the faulting address is ASCII text (string used as a pointer)

Three separate EXCEPTION_ACCESS_VIOLATION crashes in one day, and the faulting addresses are
not random — they decode to ASCII. That is the signature of a char*/FString payload being
dereferenced as an object pointer somewhere in the parameter-handling path.

Environment

• Engine: UE 5.8.0, CL 55116800, ++UE5+Release-5.8
• Plugin: UnrealMCPython 2.2.0
• OS: Windows 11

The three crashes

Unhandled Exception: EXCEPTION_ACCESS_VIOLATION reading address 0x00006e6f68747968
Unhandled Exception: EXCEPTION_ACCESS_VIOLATION reading address 0x00007465736c6f18
Unhandled Exception: EXCEPTION_ACCESS_VIOLATION reading address 0x0000000000736e18

Decoding the low bytes as ASCII (little-endian):

address	bytes	reads as
0x00006e6f68747968	68 79 74 68 6f 6e	hytho n -> "python"
0x00007465736c6f18	18 6f 6c 73 65 74	olset -> "toolset"
0x0000000000736e18	18 6e 73	ns

A genuine memory-corruption fault would give arbitrary addresses. Addresses that spell out
words from the very strings being passed across the bridge point at type confusion in
marshalling, not at heap damage.

Context

All three occurred while driving the plugin over the MCPython TCP bridge with
util.execute_python and blueprint.* actions. Every crash report from that session has
UnrealEditor-PythonScriptPlugin.dll frames in the stack (35 frames across the set), and
several have FMCPythonTcpServer::ProcessDataOnGameThread() [MCPythonTcpServer.cpp:374].

I was not able to isolate a single deterministic repro for these three — unlike #65 and #66,
which both reproduce on demand. Filing them because the address pattern is specific enough to
be actionable on its own, and because it is the same dispatch path as those two.

Suggested investigation

Audit the parameter unmarshalling in ProcessDataOnGameThread for places where a JSON string
value can reach a pointer-typed slot without a type check — particularly any path handling
object/class/struct pin values or refPath-style asset references, where a string and an
object reference are easy to conflate.