http://bugs.winehq.org/show_bug.cgi?id=21522
--- Comment #8 from Nikolay Sivov bunglehead@gmail.com 2010-10-23 15:35:35 CDT --- Looks like this is fixed by commit f73c8c4d42c03a886675c8824f16678522ed17a6. Another case of wrong use of source and dest in VARIANT coercion.
Francisco, could you try to revert it to confirm a crash is back without this fix?