The length of the ANSI string doesn't necessarily match the length of the Unicode string after conversion. We should be checking the return value of MultiByteToWideChar to find out whether the converted string fit.
Why aren't the 'strlenW(szTemp) + strlenW(lpszFile)' test and uses of lstrcpynW in PathCombineW sufficient to avoid stack corruption?