[Bug 21940] New: Rise of Legends Demo crashes with null pointer reference in msxml3?

http://bugs.winehq.org/show_bug.cgi?id=21940

Summary: Rise of Legends Demo crashes with null pointer
                    reference in msxml3?
           Product: Wine
           Version: 1.1.40
          Platform: x86
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: msxml3
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

Once you get past bug 19539, you have to choose to ignore
two BHG errors; the game then starts and runs (though I got
no sound).  Trying to play a campaign crashed for me quickly with
an msxml3 error (which is funny, since I had done winetricks msxml3,
and winecfg shows the override, but the backtrace still shows Wine's msxml3):

Unhandled exception: page fault on read access to 0x00000000 in 32-bit code
(0x7362be22).
Backtrace:
=>0 priv_from_xmlDocPtr+0x6(doc=(nil)) [dlls/msxml3/domdoc.c:127] in msxml3
  1 xmldoc_add_ref+0x1d(doc=(nil)) [dlls/msxml3/domdoc.c:160] in msxml3
  2 init_xmlnode+0x26(This=0x3fb63f8, node=0x7e222980, outer=0x3fb6418,
dispex_data=0x73666dec) [dlls/msxml3/node.c:1714] in msxml3
  3 create_element+0x6c(element=0x7e222980) [dlls/msxml3/element.c:797] in
msxml3d
  4 create_node+0x9d(node=0x7e222980) [dlls/msxml3/node.c:1736] in msxml3
  5 queryresult_nextNode+0xdf(iface=0x3ff1120, nextItem=0x32ad60)
[dlls/msxml3/queryresult.c:267] in msxml3
  6 xmlnode_selectSingleNode+0xd3(iface=0x1e9510, kqueryString="TRIBE_MASK",
resultNode=0x32ad60) [dlls/msxml3/node.c:1542] in msxml3
  7 in legends (+0x6f34c) (0x0032b2dc)
  ...
0x7362be22 priv_from_xmlDocPtr+0x6 [dlls/msxml3/domdoc.c:127] in msxml3: movl  
 0x0(%eax),%eax
127        return doc->_private;