Reproduced, and backtrace attached.
A lot of things going in that backtrace, but I suspect that the bug is as simple as ap_dipl_battle_win() not clipping the chance after all the modifications. As the calls in the backtrace are only using such value acquired earlier, I need to add logging to confirm that it's what happens, on the next reproducing iteration.
Deciphering the backtrace there's a Spy who is escaping after a successful mission - teleporting to closest own city. For such a teleport (non-adjacent) move unit_move wants to figure out action to take against the city. As the spy as able to poisoning water, that is considered. It's a city-targeted action, for which the success probability comes directly from the likelihood of winning diplomatic battle. Own diplomats should not be considered for such a battle, but I'm guessing there's an allied diplomat in the city that is picked as the potential defender.
Reply To cazfi
I suspect that the bug is as simple as ap_dipl_battle_win() not clipping the chance after all the modifications.
Confirmed to be the cause.
S3_0 autogame with variant2 ruleset ended to failing assert "action_is_signal(chance) || chance.max < 200"
I'll try to reproduce, but each iteration is going to take some time as this seems to have happened on turn 2842 (and as loading from the savegame does not result in exactly same state as continuous run from the beginning, we have to make each reproducing run from the beginning)