Found out what triggers the crashes: it is *not* the lexicographically lowest someotheruser, it is a someotheruser with a group acl active on its INBOX. If you manually remove the group acl from the affected mailbox's acl file, access is possible as granted to users in the remaining acl lines.
This can be tested just by dovecot acl debug - it crashes the same way as the imap process and is much easier to debug. To provoke crashing, just issue something like:
$ doveadm acl add -u someuser shared/someotheruser/INBOX group=somegroup lookup
This command will try to rmdir someotheruser's inbox file, then crash, plus any subsequent calls like
$ doveadm acl debug -u someuser shared/someotheruser/INBOX
will crash as well.
The rmdir phaenomenon is showing with doveadm acl debug, as well. It doesn't appear to be directly related to the crashes on group acls, however. For example, after "repairing" the ACL:
$ doveadm acl debug -u someuser shared/someotheruser
(note: /INBOX is missing here, as explicit inbox is configured), will try to rmdir /var/mail/someotheruser and then will show that noch such Mailbox exists, whereas
$ doveadm acl debug -u someuser shared/someotheruser2
simply shows that such a Mailbox doesn't exist in the given namespace.
I have no idea what is triggering the different behaviour between someotheruser and someotheruser2.