I found some clues on my cloth crash.
the cloth is enabled to be simulated in both server and client side.
I am not sure why 2 identical clothes run in physx could cause invalid particle data.
the crash occurs while creating cloth enabled tsStatic using script in console.
the reason is Andrew's cloth code check physics world of client side while creating cloth, if the client world doesn't exist, nothing will happen. If client world exist, then create cloth in the world.
when loading the test mission with cloth in it, the server world will be created first, then load the shapes to the server side, create client world , then load shapes in client. while enabling cloth in server side, the code ask for client world, but the world doesn't exist, then nothing to do.
while create shape in the console, the client world is already there, the shape will be added twice in both server and client side, and are both created in the client world.
I tried to check isServerObject() in _enableCloth(), and it stopped crashing.