Installing winamp5 with winver=winxp reveals that the wma installer calls GetSecurityDescriptorDacl with pSecurityDescriptor == NULL, which then calls RtlGetDaclSecurityDescriptor, which immediately dereferences it and crashes.
Reading MSDN indicates that pSecurityDescriptor may be NULL, but I don't know the first thing about NT security descriptors, and so I'm not sure what the right way to handle it is. But I thought I'd at least point it out so someone who does know could take a look.
-- Bobby Bingham