Steps to Reproduce

There are three cases I've found when RichTextBox throws different errors.

Compile the attached solution or run compiled exe on Linux or Windows ( with --debug option ) and follow the application instructions:

1. Press: 1, Enter, 2, Backspace, Backspace, Ctrl+Z
   Ubuntu 16.4.2 desktop i386 (bug), Debian 9.9.0 desktop i386 (bug), Win7 x64 (bug)

2. Press: 1, Enter, 2, 3, 4, 5, Backspace, Backspace, 6, 7, Ctrl+Z, Ctrl+Z, Ctrl+Z, Ctrl+Z ( four times )
   Ubuntu 16.4.2 desktop i386 (bug), Debian 9.9.0 desktop i386 (bug), Win7 x64 (ok)

3. Press the button "Send Text For (3) Case", then move cursor at the end of the LAST LINE WITH TEXT and press: 1, 2, 3, 4, 5, 6, Backspace, Backspace, Backspace, 7, Ctrl+Z, Ctrl+Z, Ctrl+Z, Ctrl+Z ( four times )
   Ubuntu 16.4.2 desktop i386 (bug), Debian 9.9.0 desktop i386 (bug), Win7 x64 (bug)

Test project solution and compiled binaries:
RichTextBox_AcceptsTab_exceptions_test.zip

Current Behavior

Text editing via RichTextBox is like walking on a minefield. It can crashes at any time when you press Ctrl+Z.
When you press Ctrl+Z, cursor moves, but characters do not delete. It's strange behaviour for the UNDO command.
The REDO command ( Ctrl+Y ) doesn't work at all.

Expected Behavior

The UNDO/REDO commands must work predictable like in any text editor.

On which platforms did you notice this

[ ] macOS
[* ] Linux
[* ] Windows

not tested on macOS (!)

Version Used:

Mono 32-bit 5.20.1.19

The attached solution tested on SharpDevelop 4.4.2 and MonoDevelop 7.8.2 (build 2).

Stacktrace

1. The stacktrace for the first case:

System.NullReferenceException: Object reference not set to an instance of an object
at System.Windows.Forms.LineTag.FindTag (System.Windows.Forms.Line line, System.Int32 pos) [0x00000] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.Document.Split (System.Windows.Forms.Line line, System.Int32 pos) [0x00000] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.UndoManager.Insert (System.Windows.Forms.Line line, System.Int32 pos, System.Windows.Forms.Line insert, System.Boolean select) [0x0000b] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.UndoManager.Undo () [0x0015c] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.TextBoxBase.Undo () [0x00000] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.TextBoxBase.ProcessKey (System.Windows.Forms.Keys keyData) [0x000bf] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.TextBoxBase.WndProc (System.Windows.Forms.Message& m) [0x0005b] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.RichTextBox.WndProc (System.Windows.Forms.Message& m) [0x00000] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.Control+ControlWindowTarget.OnMessage (System.Windows.Forms.Message& m) [0x00000] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.Control+ControlNativeWindow.WndProc (System.Windows.Forms.Message& m) [0x0000b] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.NativeWindow.WndProc (System.IntPtr hWnd, System.Windows.Forms.Msg msg, System.IntPtr wParam, System.IntPtr lParam) [0x00085] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0

2. The stacktrace for the second case:

System.IndexOutOfRangeException: Index was outside the bounds of the array.
at System.Windows.Forms.Document.Invalidate (System.Windows.Forms.Line start, System.Int32 start_pos, System.Windows.Forms.Line end, System.Int32 end_pos) [0x0006d] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.Document.SetSelectionToCaret (System.Boolean start) [0x00006] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.UndoManager.Undo () [0x00123] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.TextBoxBase.Undo () [0x00000] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.TextBoxBase.ProcessKey (System.Windows.Forms.Keys keyData) [0x000bf] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.TextBoxBase.WndProc (System.Windows.Forms.Message& m) [0x0005b] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.RichTextBox.WndProc (System.Windows.Forms.Message& m) [0x00000] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.Control+ControlWindowTarget.OnMessage (System.Windows.Forms.Message& m) [0x00000] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.Control+ControlNativeWindow.WndProc (System.Windows.Forms.Message& m) [0x0000b] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.NativeWindow.WndProc (System.IntPtr hWnd, System.Windows.Forms.Msg msg, System.IntPtr wParam, System.IntPtr lParam) [0x00085] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0

3. The stacktrace for the third case:

System.ArgumentOutOfRangeException: startIndex cannot be larger than length of string.
Parameter name: startIndex
at System.Text.StringBuilder.ToString (System.Int32 startIndex, System.Int32 length) [0x0001f] in <6649516e5b3542319fb262b421af0adb>:0
at System.Windows.Forms.Document.Split (System.Windows.Forms.Line line, System.Windows.Forms.LineTag tag, System.Int32 pos) [0x0015d] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.Document.Split (System.Windows.Forms.Line line, System.Int32 pos) [0x00008] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.UndoManager.Insert (System.Windows.Forms.Line line, System.Int32 pos, System.Windows.Forms.Line insert, System.Boolean select) [0x0000b] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.UndoManager.Undo () [0x0015c] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.TextBoxBase.Undo () [0x00000] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.TextBoxBase.ProcessKey (System.Windows.Forms.Keys keyData) [0x000bf] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.TextBoxBase.WndProc (System.Windows.Forms.Message& m) [0x0005b] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.RichTextBox.WndProc (System.Windows.Forms.Message& m) [0x00000] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.Control+ControlWindowTarget.OnMessage (System.Windows.Forms.Message& m) [0x00000] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.Control+ControlNativeWindow.WndProc (System.Windows.Forms.Message& m) [0x0000b] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0
at System.Windows.Forms.NativeWindow.WndProc (System.IntPtr hWnd, System.Windows.Forms.Msg msg, System.IntPtr wParam, System.IntPtr lParam) [0x00085] in <8aef12e05d8341c2ba53ae50a7bb2ab8>:0