The HAL_PCD_EP_Open function configures an out endpoint so that the host can actually write data to it, which is kind of a problem because if you did not use HAL_PCD_EP_Receive then ep->xfer_buff is NULL and USB_ReadPMA will generate a hard fault :(
To fix it I changed
PCD_SET_EP_RX_STATUS(USBx, ep->num, USB_EP_RX_VALID);
to
PCD_SET_EP_RX_STATUS(USBx, ep->num, USB_EP_RX_NAK); // was USB_EP_RX_VALID
in
HAL_StatusTypeDef USB_ActivateEndpoint(USB_TypeDef *USBx, USB_EPTypeDef *ep)
I am using STM32Cube_FW_F1_V1.8.0.
