This bug appears after a change in glib, as it works fine with the 2.26 series.

Some traces:
(gdb) bt full
#0  0x4025dcf6 in g_object_ref (_object=0x18c71f0) at gobject.c:2884
        __inst = 0x18c71f0
        __r = <optimized out>
        _g_boolean_var_ = <optimized out>
        object = 0x18c71f0
        old_val = <optimized out>
        __PRETTY_FUNCTION__ = "g_object_ref"
#1  0x401ee382 in _nm_object_cache_get (path=0x18ce3a0 "\300\240\214\001Xڊ\001`ٌ\001\001", path@entry=0x18c86a0 "/org/freedesktop/NetworkManager/AccessPoint/0") at nm-object-cache.c:64
        object = <optimized out>
#2  0x401e2ad6 in handle_object_property (synchronously=0, pi=0x18ada58, value=0x18d7d10, property_name=<optimized out>, self=0x18ca0c0) at nm-object.c:740
        priv = 0x18ca088
        obj = <optimized out>
        odata = 0x18ce3a0
        path = 0x18c86a0 "/org/freedesktop/NetworkManager/AccessPoint/0"
#3  handle_property_changed (self=self@entry=0x18ca0c0, dbus_name=<optimized out>, value=value@entry=0x18d7d10, synchronously=synchronously@entry=0) at nm-object.c:871
        priv = <optimized out>
        prop_name = 0x18dc978 "active-access-point"
        pi = 0x18ada58
        pspec = <optimized out>
        success = 0
        found = 1
        iter = <optimized out>
        __func__ = "handle_property_changed"
        __PRETTY_FUNCTION__ = "handle_property_changed"
#4  0x401e2bf6 in process_properties_changed (synchronously=0, properties=<optimized out>, self=0x18ca0c0) at nm-object.c:905
        iter = {dummy1 = 0x18d6d30, dummy2 = 0x18ea618, dummy3 = 0x48, dummy4 = 4, dummy5 = 26045744, dummy6 = 0x2}
        value = 0x18d7d10
        name = 0x18dd358
#5  process_properties_changed (self=0x18ca0c0, properties=<optimized out>, synchronously=0) at nm-object.c:893
        priv = <optimized out>
#6  0x4025cd28 in g_cclosure_marshal_VOID__BOXED (closure=0x18ad998, return_value=<optimized out>, n_param_values=<optimized out>, param_values=0x18ea600, invocation_hint=0xbefb758c, marshal_data=0x0) at gmarshal.c:1120
        callback = 0x401e2cad <properties_changed_proxy>
        cc = 0x18ad998
        data1 = 0x18c9098
        data2 = 0x18ca0c0
        __PRETTY_FUNCTION__ = "g_cclosure_marshal_VOID__BOXED"
#7  0x404cb3aa in marshal_dbus_message_to_g_marshaller (closure=0x18ad998, return_value=0x0, n_param_values=<optimized out>, param_values=<optimized out>, invocation_hint=0xbefb758c, marshal_data=0x0) at dbus-gproxy.c:1736
        value_array = 0x1900410
        c_marshaller = 0x4025cce1 <g_cclosure_marshal_VOID__BOXED>
        proxy = <optimized out>
        message = 0x18e2018
        gsignature = <optimized out>
        types = <optimized out>
        priv = 0x18c9070
        __PRETTY_FUNCTION__ = "marshal_dbus_message_to_g_marshaller"
#8  0x4025b08c in g_closure_invoke (closure=0x18ad998, return_value=return_value@entry=0x0, n_param_values=3, param_values=param_values@entry=0xbefb75d0, invocation_hint=invocation_hint@entry=0xbefb758c) at gclosure.c:777
        marshal = 0x404cb2d5 <marshal_dbus_message_to_g_marshaller>
        marshal_data = 0x0
        real_closure = 0x18ad988
        __PRETTY_FUNCTION__ = "g_closure_invoke"
#9  0x402674e4 in signal_emit_unlocked_R (node=node@entry=0x18c3390, detail=detail@entry=244, instance=instance@entry=0x18c9098, emission_return=emission_return@entry=0x0, instance_and_params=instance_and_params@entry=0xbefb75d0) at gsignal.c:3584
        tmp = <optimized out>
        handler = 0x18ab860
        accumulator = 0x0
        emission = {next = 0x0, instance = 0x18c9098, ihint = {signal_id = 16, detail = 244, run_type = G_SIGNAL_RUN_FIRST}, state = EMISSION_RUN, chain_type = 4}
        class_closure = 0x0
        hlist = 0x4027cb60 <__PRETTY_FUNCTION__.14519>
        handler_list = 0x18ab860
        return_accu = 0x0
        accu = {g_type = 0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, 
              v_pointer = 0x0}}}
        signal_id = 16
        max_sequential_handler_number = 238
        return_value_altered = <optimized out>
#10 0x4026d152 in g_signal_emit_valist (instance=instance@entry=0x18c9098, signal_id=<optimized out>, detail=detail@entry=244, var_args=...) at gsignal.c:3328
        instance_and_params = 0xbefb75d0
        signal_return_type = 4
        param_values = 0xbefb75e8
        node = 0x18c3390
        i = <optimized out>
        n_params = 2
        __PRETTY_FUNCTION__ = "g_signal_emit_valist"
#11 0x4026d358 in g_signal_emit (instance=instance@entry=0x18c9098, signal_id=<optimized out>, detail=244) at gsignal.c:3384
        var_args = {__ap = 0xbefb77cc}
#12 0x404cb7c6 in dbus_g_proxy_emit_remote_signal (message=<optimized out>, proxy=0x18c9098) at dbus-gproxy.c:1789
        gsignature = <optimized out>
        i = <optimized out>
        interface = <optimized out>
        signal = <optimized out>
        q = <optimized out>
        name = 0x18e1300 "org-freedesktop-NetworkManager-Device-Wireless-PropertiesChanged"
        priv = <optimized out>
        msg_gsignature = 0x18ce360
#13 dbus_g_proxy_manager_filter (user_data=0x18c37a0, message=<optimized out>, connection=<optimized out>) at dbus-gproxy.c:1356
        proxy = 0x18c9098
        tri = <optimized out>
        tmp = 0x18d5940
        sender = <optimized out>
        full_list = 0x18d5940
        owned_names = <optimized out>
        manager = 0x18c37a0
#14 dbus_g_proxy_manager_filter (connection=<optimized out>, message=<optimized out>, user_data=0x18c37a0) at dbus-gproxy.c:1196
No locals.
#15 0x404e9862 in dbus_connection_dispatch (connection=connection@entry=0x18b0e40) at ../../dbus/dbus-connection.c:4631
        filter = <optimized out>
        next = 0x0
        message = 0x18e2018
        link = <optimized out>
        filter_list_copy = 0x18e64e0
        message_link = 0x18e64c8
        result = <optimized out>
        pending = <optimized out>
        reply_serial = <optimized out>
        status = <optimized out>
        found_object = <optimized out>
        __FUNCTION__ = "dbus_connection_dispatch"
#16 0x404c7558 in message_queue_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at dbus-gmain.c:90
        connection = 0x18b0e40
#17 0x402c14bc in g_main_dispatch (context=0x18b3748) at gmain.c:3058
        dispatch = 0x404c7549 <message_queue_dispatch>
        was_in_call = 0
        user_data = 0x0
        callback = 0x0
        cb_funcs = 0x0
        cb_data = 0x0
        current_source_link = {data = 0x18b3840, next = 0x0}
        need_destroy = <optimized out>
        source = 0x18b3840
        current = 0x18fe110
        i = <optimized out>
#18 g_main_context_dispatch (context=context@entry=0x18b3748) at gmain.c:3634
No locals.
#19 0x402c1706 in g_main_context_iterate (context=context@entry=0x18b3748, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3705
        max_priority = 0
        timeout = 0
        some_ready = 1
        allocated_nfds = <optimized out>
        fds = 0x19029b0
        nfds = <optimized out>
#20 0x402c176c in g_main_context_iteration (context=0x18b3748, context@entry=0x0, may_block=may_block@entry=1) at gmain.c:3766
        retval = <optimized out>
#21 0x40169c84 in g_application_run (application=0x18afc60, argc=1, argv=0xbefb7ab4) at gapplication.c:1624
        arguments = 0x1900878
        status = 0
        i = <optimized out>
        __PRETTY_FUNCTION__ = "g_application_run"



----------------------


Program received signal SIGSEGV, Segmentation fault.
0x40239cf6 in g_object_ref (_object=0x15a2110) at gobject.c:2884
2884	  g_return_val_if_fail (G_IS_OBJECT (object), NULL);
(gdb) bt full
#0  0x40239cf6 in g_object_ref (_object=0x15a2110) at gobject.c:2884
        __inst = 0x15a2110
        __r = <optimized out>
        _g_boolean_var_ = <optimized out>
        object = 0x15a2110
        old_val = <optimized out>
        __PRETTY_FUNCTION__ = "g_object_ref"
#1  0x401ca382 in _nm_object_cache_get (path=0x2 <Address 0x2 out of bounds>) at nm-object-cache.c:64
        object = <optimized out>
#2  0x401be778 in handle_object_array_property (self=self@entry=0x15a50c0, property_name=<optimized out>, value=value@entry=0xbee8f7f0, pi=pi@entry=0x1586880, synchronously=0) at nm-object.c:793
        priv = 0x15a5088
        obj = <optimized out>
        paths = 0x15dc190
        array = 0x15a501c
        path = 0x15b7310 "/org/freedesktop/NetworkManager/AccessPoint/1"
        odata = 0x41003c60
        i = <optimized out>
#3  0x401be8b4 in reload_got_pseudo_property (proxy=0x15a4098, call=<optimized out>, user_data=0x1586880) at nm-object.c:1377
        ppi = 0x1586880
        object = 0x15a50c0
        priv = 0x15a5088
        temp = 0x15dc190
        value = {g_type = 22557840, data = {{v_int = 22921616, v_uint = 22921616, v_long = 22921616, v_ulong = 22921616, v_int64 = 22921616, v_uint64 = 22921616, v_float = 4.07301636e-38, v_double = 1.132478301276505e-316, v_pointer = 0x15dc190}, {v_int = 0, v_uint = 0, 
              v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
        error = 0x15a4098
#4  0x404a695e in d_pending_call_notify (dcall=<optimized out>, data=<optimized out>) at dbus-gproxy.c:1837
        closure = <optimized out>
#5  0x404cfece in _dbus_pending_call_complete (pending=pending@entry=0x15bf888) at ../../dbus/dbus-pending-call.c:223
        user_data = <optimized out>
#6  0x404c3282 in complete_pending_call_and_unlock (connection=0x158be40, pending=0x15bf888, message=<optimized out>) at ../../dbus/dbus-connection.c:2314
No locals.
#7  0x404c56a4 in dbus_connection_dispatch (connection=connection@entry=0x158be40) at ../../dbus/dbus-connection.c:4580
        message = 0x158c200
        link = <optimized out>
        filter_list_copy = <optimized out>
        message_link = 0x15c25f0
        result = DBUS_HANDLER_RESULT_NOT_YET_HANDLED
        pending = <optimized out>
        reply_serial = <optimized out>
        status = <optimized out>
        found_object = <optimized out>
        __FUNCTION__ = "dbus_connection_dispatch"
#8  0x404a3558 in message_queue_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at dbus-gmain.c:90
        connection = 0x158be40
#9  0x4029d4bc in g_main_dispatch (context=0x158e748) at gmain.c:3058
        dispatch = 0x404a3549 <message_queue_dispatch>
        was_in_call = 0
        user_data = 0x0
        callback = 0x0
        cb_funcs = 0x0
        cb_data = 0x0
        current_source_link = {data = 0x158e840, next = 0x0}
        need_destroy = <optimized out>
        source = 0x158e840
        current = 0x15d3e40
        i = <optimized out>
#10 g_main_context_dispatch (context=context@entry=0x158e748) at gmain.c:3634
No locals.
#11 0x4029d706 in g_main_context_iterate (context=context@entry=0x158e748, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3705
        max_priority = 0
        timeout = 0
        some_ready = 1
        allocated_nfds = <optimized out>
        fds = 0x15d6018
        nfds = <optimized out>
#12 0x4029d76c in g_main_context_iteration (context=0x158e748, context@entry=0x0, may_block=may_block@entry=1) at gmain.c:3766
        retval = <optimized out>
#13 0x40145c84 in g_application_run (application=0x158ac60, argc=1, argv=0xbee8fab4) at gapplication.c:1624
        arguments = 0x15d6018
        status = 0
        i = <optimized out>
        __PRETTY_FUNCTION__ = "g_application_run"