LoadExternalBlockFile accesses mapBlockIndex without any locks. But mapBlockIndex could be in the process of being modified. The fImporting flag should protect from a p2p message causing a modification, but submitblock can be modifying mapBlockIndex at the same time as LoadExternalBlockFile is reading it.
In addition LoadExternalBlockFile calls ReadBlockFromDisk which really needs some of the variables in CBlockIndex which are accessed by GetBlockPos to be protected. All other reads of them happen to be protected by cs_main.