Crash when net35 dll used within SSRS, when certain markup is used

Using 0.18.1.0 that I compiled locally in Visual Studio 2019 Professional.

Within an SSRS report:

If I feed # Contact = Dummy (heading) to Markdig, I correctly get <h1>Contact = Dummy</h1> (and if I enable HTML for this placeholder in the report, it correctly displays as a header.)

If I feed * Contact = Dummy (bullet list) to Markdig, I get this exception:

Attempt by method 'Markdig.Helpers.DefaultObjectCache`1<System.__Canon>.NewInstance()' to access method 'Markdig.Parsers.MarkdownParser +ContainerItem..ctor()' failed.   

at System.RuntimeTypeHandle.CreateInstance(RuntimeType type, Boolean publicOnly, Boolean noCheck, Boolean& canBeCached, RuntimeMethodHandleInternal& ctor, Boolean& bNeedSecurityCheck)   
at System.RuntimeType.CreateInstanceSlow(Boolean publicOnly, Boolean skipCheckThis, Boolean fillCache, StackCrawlMark& stackMark)   
at System.Activator.CreateInstance[T]()   
at Markdig.Helpers.DefaultObjectCache`1.NewInstance()   
at Markdig.Parsers.MarkdownParser.ProcessInlines()   
at Markdig.Parsers.MarkdownParser.Parse()   
at Markdig.Markdown.ToHtml(String markdown, MarkdownPipeline pipeline)   
at ReportExprHostImpl.CustomCodeProxy.MarkdownToHtml(String str)   
at ReportExprHostImpl.CustomCodeProxy.FormatMarkdown(String strInput)

The problem is repeatable and happens on both our prod SSRS server and my local SSRS server.

When I test this same thing under a standalone VB.NET console app compiled to .NET Framework 3.5 and referencing the same net35 markdig.dll, I do not get any crashes.

Start with the stack trace at Markdig.Markdown.ToHtml and DefaultObjectCache, then reproduce the bullet-list input in SSRS using the net35 markdig.dll. Compare that behavior with the standalone .NET Framework 3.5 console test; done means the SSRS case no longer crashes while heading and bullet-list markup still parse correctly.