[Bug 17137] New: SpongeBob SquarePants Typing crashes on startup

http://bugs.winehq.org/show_bug.cgi?id=17137

Summary: SpongeBob SquarePants Typing crashes on startup
           Product: Wine
           Version: 1.1.13
          Platform: Other
               URL: http://www.imaginengine.com/products/Games/showproduct.a
                    sp?ID=297
        OS/Version: other
            Status: NEW
          Severity: normal
          Priority: P2
         Component: -unknown
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

This is an old cheap game my wife picked up; system requirements
direct x 8.1, win98+, 64MB RAM, 16 color monitor, 800x600,
graphics card with four whole megabytes of ram.

Installs ok (the ereg program crashes, but that's ok).
The game itself plays sound for a moment, then crashes.

I'll attach a +relay,+seh,+heap log.  The crash is inside a system call:

0021:Call KERNEL32.WaitForSingleObject(000000d4,00000005) ret=21101635
wine: Unhandled page fault on read access to 0x00000024 at address 0x4947c5
(thread 0009), starting debugger...

Valgrind finds four or so instances of this error:

==8670== Invalid free() / delete / delete[]
==8670==    at 0x4739F4B: RtlFreeHeap (heap.c:219)
==8670==    by 0x77522BD: IWineGDISurfaceImpl_PrivateSetup (surface_gdi.c:523)
==8670==    by 0x76C44B4: IWineD3DDeviceImpl_CreateSurface (device.c:742)
==8670==    by 0x65EBFA4: IDirectDrawImpl_CreateNewSurface (ddraw.c:2039)
==8670==    by 0x65ED628: IDirectDrawImpl_CreateSurface (ddraw.c:2579)