Crash with SIGABRT: The specified URL has an unsupported scheme. Only HTTP and HTTPS URLs are supported.

Describe the bug
Hello, we are randomly seeing crashes in our crash-reporting indicating

The specified URL has an unsupported scheme. Only HTTP and HTTPS URLs are supported.

When we saw this the first time (march 2020) , we added a check, that verifies that the URL-scheme is really http or https. But still this bug appears again. Besides that, the URL comes from a config and uses for sure only "https".
Has anyone else seen such a crash yet?

To Reproduce
Not reproducible, only reported as crash-report anonymously.

Smartphone (please complete the following information):

• Device: iPhone 6s
• OS: iOS 13.5.1
• Browser Safari
• Version unknown

Additional context
It happens in AppAuth-iOS 1.0.0.
The stacktrace of the crash points into AppAuth:

CoreFoundation
__exceptionPreprocess
libobjc.A.dylib
objc_exception_throw
CoreFoundation
+[NSException raise:format:]
SafariServices
-[SFSafariViewController initWithURL:configuration:]
SafariServices
-[SFAuthenticationViewController initWithURL:callbackURLScheme:usingEphemeralSession:presentationContextWindow:]
SafariServices
-[SFAuthenticationSession _startRequestingFromWebAuthenticationSession:inWindow:dryRun:]
AppAuth
-[OIDExternalUserAgentIOS presentExternalUserAgentRequest:session:] OIDExternalUserAgentIOS.m:114
AppAuth
-[OIDAuthorizationFlowSessionImplementation presentAuthorizationWithExternalUserAgent:callback:] OIDAuthorizationService.m:82
AppAuth
+[OIDAuthorizationService presentAuthorizationRequest:externalUserAgent:callback:] OIDAuthorizationService.m:415
AppAuth
+[OIDAuthState authStateByPresentingAuthorizationRequest:externalUserAgent:callback:] OIDAuthState.m:113
AppAuth
+[OIDAuthState(IOS) authStateByPresentingAuthorizationRequest:presentingViewController:callback:] OIDAuthState+IOS.m:32

Start at OIDExternalUserAgentIOS.m:114 and trace the URL passed into SFSafariViewController, using the supplied stack trace as the entry point. The report is not reproducible, so done means identifying the source of the unsupported scheme and establishing a reliable way to verify the affected authorization path no longer crashes.