http://bugs.winehq.org/show_bug.cgi?id=26389
--- Comment #7 from Bruno Jesus 00cpxxx@gmail.com 2011-11-20 11:09:50 CST --- The agressor is in EDIT_LockBuffer:
Line 1195 es->text = LocalLock(es->hloc32W);
This memory alloc fails and is not tested, fortunately the next function called (MultiByteToWideChar) protects itself agains NULL pointers.