it did fail here... good karma on your side I guess?
Failure only happens when range_GetChar gets inlined inside ITextSelection_fnGetChar (and later functions local variables where thrashed by the overflow in buffer from the inlined function).
(so it could depend on compiler version as well ;-)