### Godot version

4.1.1.stable

### System information

Godot v4.1.1.stable (bd6af8e0e) - Freedesktop SDK 22.08 (Flatpak runtime) - Vulkan (Forward+) - integrated AMD Custom GPU 0405 (RADV VANGOGH) () - AMD Custom APU 0405 (8 Threads)

### Issue description

Closing all scene tabs in Godot results with a crash with following signature:

```
Godot Engine v4.1.1.stable.flathub.bd6af8e0e - https://godotengine.org
Vulkan API 1.3.246 - Forward+ - Using Vulkan Device #0: AMD - AMD Custom GPU 0405 (RADV VANGOGH)

handle_crash: Program crashed with signal 11
Engine version: Godot Engine v4.1.1.stable.flathub (bd6af8e0ea69167dd0627f3bd54f9105bda0f8b5)
Dumping the backtrace. Please include this when reporting the bug to the project developer.
ERROR: FATAL: Index p_index = 1 is out of bounds (size() = 0).
   at: get (./core/templates/cowdata.h:155)
```

Since this is a release build which is missing debug symbols, the whole backtrace is not visible. Due to that, I have downloaded source code and build myself a debug version (latest commit on master available at the time) of Godot and got the following more insightful backtrace:

```
handle_crash: Program crashed with signal 11
Engine version: Godot Engine v4.2.dev.custom_build (6588a4a29af1621086feac0117d5d4d37af957fd)
Dumping the backtrace. Please include this when reporting the bug to the project developer.
[1] /usr/lib/libc.so.6(+0x38a00) [0x7f11002dea00] (??:0)
[2] /run/media/mmcblk0p1/godot/bin/godot.linuxbsd.editor.dev.x86_64(__dynamic_cast+0x2d) [0x55bffe1e44bd] (??:?)
[3] Node* Object::cast_to<Node>(Object*) (/opt/workspace/./core/object/object.h:764 (discriminator 1))
[4] VariantObjectClassChecker<Node*>::check(Variant const&) (/opt/workspace/./core/variant/binder_common.h:230)
[5] VariantCasterAndValidate<Node*>::cast(Variant const**, unsigned int, Callable::CallError&) (/opt/workspace/./core/variant/binder_common.h:256 (discriminator 2))
[6] void call_with_variant_args_helper<__UnexistingClass, Dictionary, Node*, 0ul, 1ul>(__UnexistingClass*, void (__UnexistingClass::*)(Dictionary, Node*), Variant const**, Callable::CallError&, IndexSequence<0ul, 1ul>) (/opt/workspace/./core/variant/binder_common.h:303 (discriminator 4))
[7] void call_with_variant_args_dv<__UnexistingClass, Dictionary, Node*>(__UnexistingClass*, void (__UnexistingClass::*)(Dictionary, Node*), Variant const**, int, Callable::CallError&, Vector<Variant> const&) (/opt/workspace/./core/variant/binder_common.h:451)
[8] MethodBindT<Dictionary, Node*>::call(Object*, Variant const**, int, Callable::CallError&) const (/opt/workspace/./core/object/method_bind.h:331)
[9] Object::callp(StringName const&, Variant const**, int, Callable::CallError&) (/opt/workspace/core/object/object.cpp:739 (discriminator 1))
[10] Callable::callp(Variant const**, int, Variant&, Callable::CallError&) const (/opt/workspace/core/variant/callable.cpp:62)
[11] CallQueue::_call_function(Callable const&, Variant const*, int, bool) (/opt/workspace/core/object/message_queue.cpp:220)
[12] CallQueue::flush() (/opt/workspace/core/object/message_queue.cpp:326)
[13] SceneTree::physics_process(double) (/opt/workspace/scene/main/scene_tree.cpp:473)
[14] Main::iteration() (/opt/workspace/main/main.cpp:3396)
[15] OS_LinuxBSD::run() (/opt/workspace/platform/linuxbsd/os_linuxbsd.cpp:912)
[16] /run/media/mmcblk0p1/godot/bin/godot.linuxbsd.editor.dev.x86_64(main+0x19f) [0x55bff8d0f4e8] (/opt/workspace/platform/linuxbsd/godot_linuxbsd.cpp:76)
[17] /usr/lib/libc.so.6(+0x23290) [0x7f11002c9290] (??:0)
[18] /usr/lib/libc.so.6(__libc_start_main+0x8a) [0x7f11002c934a] (??:0)
[19] /run/media/mmcblk0p1/godot/bin/godot.linuxbsd.editor.dev.x86_64(_start+0x25) [0x55bff8d0f285] (??:?)
-- END OF BACKTRACE --
```

Based on the fact that I am a total beginner with Godot code base, and that I know that the Godot 4.0.3 doesn't have this issue, and the fact that this is trivial to reproduce, I have decided to use `git bisect` to find the first bad commit which is:

```
commit ddc856702264cf892cea6e19f57d750ab824952a
Author: kobewi <kobewi4e@gmail.com>
Date:   Fri Oct 14 20:41:05 2022 +0200

    Scene tab closing refactor
```

This commit from Kobe helped me tremendously to focus on just a small code path. Together with this information and a couple of sessions with GDB, I have found the following:

```
Thread 1 "godot.linuxbsd." received signal SIGSEGV, Segmentation fault.
0x000055555d3a4e3d in __dynamic_cast ()
(gdb) bt
#0  0x000055555d3a4e3d in __dynamic_cast ()
#1  0x0000555557d4d700 in Object::cast_to<Node> (p_object=0x555560f5eee0) at ./core/object/object.h:754
#2  0x00005555587413e6 in VariantObjectClassChecker<Node*>::check (p_variant=...) at ./core/variant/binder_common.h:220
#3  0x0000555558741290 in VariantCasterAndValidate<Node*>::cast (p_args=0x7fffffffd860, p_arg_idx=1, r_error=...) at ./core/variant/binder_common.h:246
#4  0x00005555598ab795 in call_with_variant_args_helper<__UnexistingClass, Dictionary, Node*, 0ul, 1ul> (p_instance=0x55556382d4c0, 
    p_method=(void (__UnexistingClass::*)(__UnexistingClass * const, Dictionary, Node *)) 0x555559839456 <EditorNode::_set_main_scene_state(Dictionary, Node*)>, p_args=0x7fffffffd860, r_error=...) at ./core/variant/binder_common.h:293
#5  0x00005555598a9ef1 in call_with_variant_args_dv<__UnexistingClass, Dictionary, Node*> (p_instance=0x55556382d4c0, p_method=(void (__UnexistingClass::*)(__UnexistingClass * const, Dictionary, Node *)) 0x555559839456 <EditorNode::_set_main_scene_state(Dictionary, Node*)>, 
    p_args=0x7fffffffda80, p_argcount=2, r_error=..., default_values=...) at ./core/variant/binder_common.h:440
#6  0x00005555598a491a in MethodBindT<Dictionary, Node*>::call (this=0x55557108d130, p_object=0x55556382d4c0, p_args=0x7fffffffda80, p_arg_count=2, r_error=...) at ./core/object/method_bind.h:324
#7  0x000055555ce7c423 in Object::callp (this=0x55556382d4c0, p_method=..., p_args=0x7fffffffda80, p_argcount=2, r_error=...) at core/object/object.cpp:733
#8  0x000055555cac8c13 in Callable::callp (this=0x7ffff2753af0, p_arguments=0x7fffffffda80, p_argcount=2, r_return_value=..., r_call_error=...) at core/variant/callable.cpp:62
#9  0x000055555ce76036 in MessageQueue::_call_function (this=0x555561238e60, p_callable=..., p_args=0x7ffff2753b08, p_argcount=2, p_show_error=false) at core/object/message_queue.cpp:229
#10 0x000055555ce7639d in MessageQueue::flush (this=0x555561238e60) at core/object/message_queue.cpp:275
#11 0x000055555ab31046 in SceneTree::physics_process (this=0x5555638337f0, p_time=0.016666666666666666) at scene/main/scene_tree.cpp:430
#12 0x0000555557d44ea0 in Main::iteration () at main/main.cpp:3131
#13 0x0000555557cbab78 in OS_LinuxBSD::run (this=0x7fffffffdd90) at platform/linuxbsd/os_linuxbsd.cpp:889
#14 0x0000555557cb12d8 in main (argc=4, argv=0x7fffffffe2d8) at platform/linuxbsd/godot_linuxbsd.cpp:73
(gdb) frame 9
#9  0x000055555ce76036 in MessageQueue::_call_function (this=0x555561238e60, p_callable=..., p_args=0x7ffff2753b08, p_argcount=2, p_show_error=false) at core/object/message_queue.cpp:229
(gdb) p *p_callable.method._data
$4 = {refcount = {count = {value = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 8}, static is_always_lock_free = true}}}, static_count = {value = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 1}, 
      static is_always_lock_free = true}}, cname = 0x0, name = {_cowdata = {_ptr = 0x55557108a8d0 U"_set_main_scene_state"}, static _null = 0 U'\000', static invalid_node_name_characters = {_cowdata = {_ptr = 0x555560f14470 U". : @ / \" %"}, static _null = 0 U'\000', 
      static invalid_node_name_characters = <same as static member of an already seen type>}}, debug_references = 0, idx = 10433, hash = 704063681, prev = 0x0, next = 0x55556319f4a0}
```

From this backtrace, it can be seen that the method `_set_main_scene_state` is called deferred (on the next call to physics_process) for each of the scenes that Godot actually removed. Since a scene is removed (memory holding this scene has been de-allocated), `dynamic_cast` casts an invalid address (address that Godot now doesn't have an access to anymore) which results in SIGSEGV.

This issue is reproducible on 4.1 as well as on master branch.

### Steps to reproduce

Issue is trivial to reproduce with reproduction rate of 100%. No special project configuration is needed. The only precondition is to have multiple scene files available in a project. For your convenience, attached is a test project from which this issue can be reproduced.

Steps to reproduce this issue are following:

1. Open the attached project in Godot.
2. Open two or more scenes. More then one scene has to be open for editing, otherwise the issue will not be triggered.
3. Right click on one of the opened scene tabs and from the popup menu click on "Close All Tabs".

The last step will cause Godot to crash.

### Minimal reproduction project

[test.tar.gz](https://github.com/godotengine/godot/files/12179462/test.tar.gz)
center_split->set_split_offset(old_split_ofs);
}
void EditorNode::_add_to_recent_scenes(const String &p_scene) {
	Array rc = EditorSettings::get_singleton()->get_project_metadata("recent_files", "scenes", Array());
	if (rc.has(p_scene)) {
		rc.erase(p_scene);
	}
	rc.push_front(p_scene);
	if (rc.size() > 10) {
		rc.resize(10);
	}
	EditorSettings::get_singleton()->set_project_metadata("recent_files", "scenes", rc);
	_update_recent_scenes();
}
void EditorNode::_open_recent_scene(int p_idx) {
	if (p_idx == recent_scenes->get_item_count() - 1) {
		EditorSettings::get_singleton()->set_project_metadata("recent_files", "scenes", Array());
		call_deferred(SNAME("_update_recent_scenes"));
	} else {
		Array rc = EditorSettings::get_singleton()->get_project_metadata("recent_files", "scenes", Array());
		ERR_FAIL_INDEX(p_idx, rc.size());
		if (load_scene(rc[p_idx]) != OK) {
			rc.remove_at(p_idx);
			EditorSettings::get_singleton()->set_project_metadata("recent_files", "scenes", rc);
			_update_recent_scenes();
		}
	}
}
void EditorNode::_update_recent_scenes() {