http://bugs.winehq.org/show_bug.cgi?id=29974
--- Comment #2 from Nikolay Sivov bunglehead@gmail.com 2012-02-22 06:03:58 CST --- The reason here is most likely that HTHEME should really be a handle, not a pointer to some data. This way all public calls are able to validate and we blindly dereference it now. I think we had a similar bug some time ago, should still be open.