QTextCursor::beginEditBlock() crash after replacing text with shorter text

The sequence is:

QTextCursor::beginEditBlock()
a loop to find text and replace with shorter text
QTextCursor::endEditBlock()
QPlainTextEdit::setTextCursor() <=== CRASH

Build the attached project with Qt 5.4. Click the Crash button, and it crashes on an assert:
ASSERT failure in QVector<T>::operator[]: "index out of range", file ../../include/QtCore/../../../../../qt/qtbase/src/corelib/tools/qvector.h, line 396

If you remove the call to QTextCursor::beginEditBlock(), the crash doesn't happen.

Replacing text with longer text, no crash.

Build with Qt 4.8.6, works as expected

Crashes on both Macintosh and Windows