QGCCorePlugin is currently constructed with a QGCToolbox* toolbx parameter of null. This is because at the time QGCCorePlugin (or an actual custom plugin) is constructed app->toolbox() is null.
_scanAndLoadPlugins() is called as part of the QGCToolbox constructor where all toolbox classes use the same format:
_class = new Class(app, this);

The creation of QGCCorePlugin should follow the same pattern.

The practical issue I had with this is that because the parent is not set correctly, QGCCorePlugin is not destructed when the app is closed. This means any code in the destructor is not run. (QGCCorePlugin itself has as a destructor which is currently not being called).