Given that the second opened file exists and contains text TEST TXT (two words starting with T) the following script is enough to crash:

 vim --cmd 'set columns=5000 noswapfile' -u NONE -i NONE -N /tmp/b $PWD/"$(perl -e "print ((('/'.('d' x 255)) x 4).'/'.('a' x 255))")" -s <(<<< $'iT\C-n')

Note that bash supports neither <<< nor \C-n in $'', need echo and actual value. Bug was found by coverity in Neovim (CID 56813), at the end of ins_compl_next function (where it copies compl_shown_match->cp_fname + i into IObuff). It is necessary that columns value is large.

Checked with vim 8.0.512.