Esme Povirk (@madewokherd) commented about dlls/uiautomationcore/uia_event.c:
{ if (node_data->hwnd) {
hr = uia_event_invoke(node, (HUIANODE)&node_data->IWineUiaNode_iface, args, event);
*clientside_nav_node_out = (HUIANODE)&node_data->IWineUiaNode_iface;
IWineUiaNode_AddRef(&node_data->IWineUiaNode_iface);
in_scope = TRUE; break; }
Earlier, clientside_nav_node_out is checked for NULL, but not here. I guess the idea is that clientside_nav_node_out will always be non-NULL for serverside events, which makes sense, but it might be good to enforce this with an assert earlier in the function.