It took a while but I found the culprit. The crash is most likely because the window is (about to be) destroyed.

The only thing left to do is to fix the 211 test failures on NT4.

I fixed a typo while at it and used a define instead of a magic value.

Are you sure this is the right fix?
Is this crash not caused by the loop, and not the actual call to the menu?

Other test-cases call the same API without this problem.

/pedro