I found a bug in _mqx_init_interrupt_stack() routine where the stack base address is obtained from this line of code.
stack_ptr = (_mqx_uint)*(_mqx_uint*)0x0; /* Get stack base address located on interrupt vector 0. */
Since the interrupt vector relocates to a different address (for instance, 0xa000) when using a bootloader, the above line would result in an incorrect value for stack_ptr which in turn results in incorrect INIT.INTERRUPT_STACK_SIZE. This was causing a hard-fault in my case when _sched_start_internal() is called. The right way to fix it is to get the stack base address from VTOR as below.
stack_ptr = (_mqx_uint)*(_mqx_uint*)SCB->VTOR;
By the way, I was using FRDM-K22F board with freedom bootloader to debug this issue and I also noticed that this issue is fixed in KSDK 1.3.0.