NServiceBus 6.1.2 NullReferenceException when scanning does not locate message type

packages.config

<?xml version="1.0" encoding="utf-8"?>
<packages>
  <package id="NServiceBus" version="6.1.2" targetFramework="net46" />
</packages>

Program.cs

using NServiceBus;
using System;
using System.IO;
using System.Reflection;

namespace NServiceBusAssemblyScanCrash
{
    class Program
    {
        public class Message
        {

        }

        static void Main(string[] args)
        {
              //Make sure NServiceBus is loaded before we change the base directory
              Assembly.Load("NServiceBus.Core");
              
              //The message is sent just fine if we don't change the base directory here
              ChangeAppDomainBaseToSubdir("empty");

            try
            {
                var conf = new EndpointConfiguration("test");
                conf.Conventions().DefiningCommandsAs(t => t == typeof(Message));
                conf.SendOnly();
                conf.UsePersistence<InMemoryPersistence>();
                var endpoint = Endpoint.Start(conf).GetAwaiter().GetResult();

                var dest = new SendOptions();
                dest.SetDestination("test@localhost");
                endpoint.Send(new Message(), dest);

                Console.WriteLine("Message sent");
            }
            catch (Exception e)
            {
                Console.WriteLine($"{e.GetType().FullName}: {e.Message}");
                Console.Write(e.StackTrace);
                Console.WriteLine();
            }

            Console.WriteLine("Press any key");
            Console.Read();
        }

        private static void ChangeAppDomainBaseToSubdir(string subdir)
        {
            var new_appbase = Path.Combine(AppDomain.CurrentDomain.BaseDirectory, "empty");
            if (!Directory.Exists(new_appbase))
            {
                Directory.CreateDirectory(new_appbase);
            }
            AppDomain.CurrentDomain.SetData("APPBASE", new_appbase);
        }
    }
}