Looks like `tls_threads_mode = 2` solved the issue. Has been running for more than 4 days now.
BTW: We found out that the crash could actually be triggered by running `nmap --script ssl-enum-ciphers -p 5061 example.com`, too. After some requests, Kamailio crashed and nmap returned with an incomplete number of ciphers.