[Bug 20954] New: Adobe CS4 installer crashes when going back, then continuing

http://bugs.winehq.org/show_bug.cgi?id=20954

Summary: Adobe CS4 installer crashes when going back, then
                    continuing
           Product: Wine
           Version: 1.1.34
          Platform: PC
               URL: http://trials.adobe.com/Applications/Photoshop/CS4/Win
                    /ADBEPHSPCS4_LS1.7z
        OS/Version: Linux
            Status: NEW
          Keywords: download, Installer
          Severity: minor
          Priority: P3
         Component: -unknown
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

Created an attachment (id=25119)
 --> (http://bugs.winehq.org/attachment.cgi?id=25119)
wine-1.1.34-99-g8da7a00 console output

To recreate:
1. Run setup.
2. Click "I wish to trial..." and click next.
3. At the license screen click back.
4. Click next again.

Setup causes a page fault and has to be killed.

Backtrace:
=>0 0x7b73d27f call_cp_func+0x55(disp=(nil), dispid=-600)
[/home/test/wine-git/dlls/mshtml/htmlevent.c:771] in mshtml (0x0033e634)
  1 0x7b73d95d call_event_handlers+0x519(doc=0x3f55218, event_obj=0x110276f8,
event_target=0x4421a68, cp_container=0x3ec1390, eid=EVENTID_CLICK,
this_obj=0x3f5524c) [/home/test/wine-git/dlls/mshtml/htmlevent.c:867] in mshtml
(0x0033e6f4)
  2 0x7b73de2e fire_event+0x3a4(doc=0x3f55218, eid=EVENTID_CLICK,
target=0x412eab4, nsevent=0x12222a24)
[/home/test/wine-git/dlls/mshtml/htmlevent.c:934] in mshtml (0x0033e764)
  3 0x7b77e334 handle_htmlevent+0x1b4(iface=0x3f553b8, event=0x12222a24)
[/home/test/wine-git/dlls/mshtml/nsevents.c:292] in mshtml (0x0033e7d4)

Tested in latest git.

Obvious workaround: don't click back.