http://bugs.winehq.org/show_bug.cgi?id=30826
--- Comment #6 from Dan Kegel dank@kegel.com 2012-06-02 20:02:11 CDT --- Yes, it does seem like a buffer overrun or use-after-free somehow.
With native gdiplus, I get
Unhandled exception: page fault on read access to 0xfeeefeee in 32-bit code (0x4ecaa381). Backtrace: =>0 0x4ecaa381 in gdiplus (+0x5a381) (0x0033ea40) 1 0x10178669 in pegrp32e (+0x178668) (0x0033ea84) 2 0x1017b6ec in pegrp32e (+0x17b6eb) (0x0033f678) 3 0x7e850d8e EnumMetaFile+0x12d(hdc=0x5ac0, hmf=0x5aa4, lpEnumFunc=0x10179090, lpData=0x33f7f0) [/home/dank/wine-git/dlls/gdi32/metafile.c:537] in gdi32 (0x0033f6d8)
I'm guessing it's an app bug, will try to confirm.