If PCRTime_GetMS overflows and a long timer item (49 days) is inserted, but the tree_index has not yet been switched to the other tree, the timer item may get called almost immediately. When the tree_index is switched, all of the timer items from the current tree are called. The traversal for the current tree should be switched so that long timer items added before the tree_index is switched will not get called at the time the tree_index is switched.
Note: the window of opportunity for this to happen is very small, timer_thread_fn should wake up and switch timer_index as soon as PCRTime_GetMS overflows, also any insertion will cause timer_thread_fn to wake up, so it would need to be the first insertion after the overflow, and before tree_index is switched by timer_thread_fn. Also it would need to be a very long timeout that causes timeout + PCRTimeGetMS to be greater than maximum uint32.