[Bug 12767] New: Crash on close of hh when showing any real help file

http://bugs.winehq.org/show_bug.cgi?id=12767

Summary: Crash on close of hh when showing any real help file
           Product: Wine
           Version: CVS/GIT
          Platform: Other
        OS/Version: other
            Status: NEW
          Keywords: download
          Severity: normal
          Priority: P2
         Component: shdocvw
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

View a .chm file with hh.exe, then close it by clicking the go-away box.
Boom!  WINEDEBUG=warn+heap makes it happen slightly sooner, I'll attach the
log.
I can reproduce this with the .chm files from autohotkey and 7-zip,
probably any will do.  Log highlights:

trace:shdocvw:WebBrowser_Release (0x1351e8) ref=0
wine: Unhandled page fault on read access to 0xaaaaaab2 at address 0x7db782f7
(thread 0009), starting debugger...
Register dump:
 CS:0073 SS:007b DS:007b ES:007b FS:0033 GS:003b
 EIP:7db782f7 ESP:0032f740 EBP:0032f758 EFLAGS:00010202(   - 00      - -RI1)
 EAX:aaaaaaaa EBX:7db8f51c ECX:00000003 EDX:00134d98
 ESI:00135284 EDI:001351e8
Backtrace:
=>1 0x7db782f7 DocHost_Release+0x34(This=0x135284) [dlls/shdocvw/dochost.c:544] 
  2 0x7db8670e WebBrowser_Release+0x56(iface=?) [dlls/shdocvw/webbrowser.c:155] 
  3 0x7db7f3d5 OleObject_Release+0x15(iface=?) [dlls/shdocvw/oleobject.c:270] 
  4 0x7e5ac339 ReleaseWebBrowser+0xa9(info=?)
[dlls/hhctrl.ocx/webbrowser.c:660] 
...
0x7db782f7 DocHost_Release+0x34 [dlls/shdocvw/dochost.c:544] in shdocvw: call  
  *0x8(%eax)
544             IOleInPlaceFrame_Release(This->frame);