ESP8266 crashes when trying to copy a string into a big char
Function local variable are created on the stack, and in the case of an ESP8266, the total size is limited to 4096 Bytes - so, 3900 for one variable is cutting it close.

I would recommend you either use malloc/free 

int str_len = payload.length() + 1;

// Prepare the character array
char *xml = (char *) malloc(str_len);

// Copy it over
payload.toCharArray(xml, str_len);

// there I'll parse xml with tinyxml2 but the MCU crashes before getting here
//
// when done, free the memory malloc'd

free(xml);


or, if you know an absolute maximum size for the string, e.g. 5000, make char xml[5001]; in the global scope