Wine doesn't crash in this function, sorry, it's a bug in pf_vsnprintf() which causes snprintf() to write beyond the end of the buffer.
I've attached a patch that fixes it for me, but it's probably better not to create such large buffers on the stack. Anyone with a better fix?
tom