Good question. I don't know.
Possibly the window procedure is declared using a calling convention that somehow mangles even the wrapper stack, so we're popping garbage off it into %ebx. But I'm out of ideas for now.
What I would suggest is putting some stack padding between the saved registers and the window proc parameters. If that makes a difference submit it to wine-patches, as it's likely that the padding has been blasted rather than the register save area.