OK, I've found a way to reproduce the D3D8.dll crash.
Technical explanation follows (only for interest)
It's related to drawing parts of track that think they have a shadow on them, when there is no such shadow texture in memory.
One way to reproduce :
Switch OFF mirrors
Select BL GP REV
Add 3 AI
Join race (in 4th place)
Start race
Wait until the AI just disappear over the hill
Exit back to game setup screen
Now LFS is in the bugged state, ready to crash, when it tries to draw the land that the AI were driving on. LFS still thinks there are shadows on that land - because it was not visible when the AI registered their shadows on the land.
To get the crash :
Remove the AI from the grid
Start race
Drive over the hill
LFS will crash when the land just over the hill is drawn.
There are two bugs here, combining to produce the crash : (1) the shadows are not cleared from being registered on land unless the land is drawn and (2) when shadows are cleared from memory (e.g. exit to game setup screen) they are not removed from a list of shadows.
In fact this bug has always been in LFS, it would just not show itself because the shadows were never cleaned up from the memory. So in old versions the bug would probably appear as a momentary flash of an invalid shadow, which would then be cleared. Almost unnoticeable. But the new shadow memory cleanups have showed up this old bug, instead causing a crash.