From the comment in GuessVerificationProgress():
//! require cs_main if pindex has not been validated yet (because nChainTx might be unset)
/interfaces/node.cpp
does not have locks on cs_main for the three calls made to GuessVerificationProgress (see getVerificationProgress, handleNotifyBlockTip, handleNotifyHeaderTip).
I believe there are other calls to GuessVerificationProgress that need similar attention.