opus_custom_encode calls celt_encode_with_ec with NULL passed as ec_enc *enc parameter.
In this function, ec_enc_shrink is called at https://github.com/xiph/opus/blob/main/celt/celt_encoder.c#L1596. enc variable gets initialized in branch below at https://github.com/xiph/opus/blob/main/celt/celt_encoder.c#L1607.
Unlike other branches that check for enc being NULL pointer, here it's omitted, causing a crash when st->bitrate isn't OPUS_BITRATE_MAX.