This is speculation, but I suspect what is happening is that while the notification process doesn't run in kernel space, a text processing library does. The unicode wstring is being sent into that library with the request to "draw this text!" (to ultimately a buffer/bitmap) and when the text processing library attempts to process the unicode string, it chokes on part of it, crashes in kernel space and iOS panics and resets.

This is speculation, but has happened before. The "good news" is that it is likely not usable to install malware or to inject running code into kernel space. The "bad news" is that people can continue to DDoS each other until it is fixed (and maybe via other apps which have notifications, like email, assuming it pushes unicode strings into the notification).

The only interesting question is why this crashes iOS with notifications but NOT with just viewing the text in the Message app? That I'd love someone to dive into (e.g. do they use different libraries to draw text?).