Where does Powershell ISE store tabs when it crashes?

This will always give you the correct path:

(Resolve-Path "$env:LOCALAPPDATA\Microsoft_Corporation\powershell_ise*").Path

Using Process Monitor, I've found that the ISE stores and loads its recovered files from:

%LOCALAPPDATA%\Microsoft_Corporation\powershell_ise.exe_StrongName_lw2v2vm3wmtzzpebq33gybmeoxukb04w\3.0.0.0\AutoSaveFiles

Holds true for both Windows 7 with PS 3.0, Windows 8.1 with PS 4.0 and Windows 10 with PS 5.1