I guess I'm a bit late to the party, but I spent essentially the week after the initial Forge release debugging this. At the time it seemed to be a "me" issue, so I didn't really put any "force" behind anything related to it.
It only seems to happen when there are "many" files (outside of jars/zips) that need to be scanned, for some definition of many. Try launching e.g. the 1.17 branch of AE2 from an MDK; I've had the same issue with the (private) 1.17 branch of IE.
In Forge dev, put a breakpoint here and check the number of stream elements on the last invocation (third for me). Kill MC, limit the stream to that number of elements in the last invocation (just using a global counter) => no crash (at least for me). Limit the stream to one more element => crash again.
I have a "highly heuristic" fix: Build this PR to securejarhandler and replace Forge's SJH dependency with it. At least for me this reliably fixes the crash, in Forge dev as well as in IE dev. I have no clue why it works, whether it's a fix or a workaround and if it will work for anyone else or just me (so I'd be interested in data on that last point).