http://bugs.winehq.org/show_bug.cgi?id=20830
--- Comment #4 from Dylan Smith dylan.ah.smith@gmail.com 2010-06-15 09:12:56 --- Basically what is happening is IRichEditOle::InsertObject is being called with pointer to a REOBJECT that has a NULL value for the poleobj field, which is simply not handled in wine.
I am not sure how windows handles this case yet. It seems as if the richole tests don't call InsertObject at all, which should probably be added to determine the proper behaviour, which is probably not crashing.