http://bugs.winehq.org/show_bug.cgi?id=9012
--- Comment #16 from Alistair Leslie-Hughes leslie_alistair@hotmail.com 2009-02-15 03:20:19 --- After some testing.
If you use either native urlmon or shdocvw the crash stops.
It appears when BINDSTATUS_CLASSIDAVAILABLE is passed to OnProgress, the processing is different in WINE. Still narrowing the the exact difference.