If I place ccref in DispatchEx, I'll have to special case it in window (outer windows don't have dispex, so I'll have to conditionally do ccref incr/decr). Is that acceptable?
I think that we should move ref out of HTMLWindow one way or another. At some point, I'd be tempted to just get rid of the whole thing like you did with HTMLDocument, but we don't need to go that far just for the ref counter. We could, for example, have separated vtbls for just one interface that we'd forward all other IUnknown functions to.
Actually we are already processing them in toString anyway (to add [object …] around it) so might as well do the ASCII→Unicode conversion there and use the name directly in traversal?
Sounds good to me.