http://bugs.winehq.org/show_bug.cgi?id=7501
------- Additional Comments From thestig@google.com 2007-21-02 00:15 ------- Here's what's going on: When the button is clicked, TOOLBAR_LButtonUp() gets called and it in turn calls SendMessageW(infoPtr->hwndNotify, WM_COMMAND, ...) which causes the destruction/creation of the toolbar. After SendMessageW() returns, the TOOLBAR_INFO struct infoPtr points to is no longer valid and you get the crash.
Destroying and recreating the toolbar seems like a really inefficient way to change the state of a button. Isn't sending the TB_SETSTATE message the proper way to do it?