Hi,
The register at 0xE000EDF8 is named NVIC_DBG_DATA and is to be found in hw_nvic.h file. It would be interesting to go to that register and see its content.
Also, the "precise" error fault can be a good indication: did you placed the right timer interrupt vector in startup_xxx.c file? did you enabled global interrupts?
Petrei