Jacek Caban (@jacek) commented about dlls/vbscript/interp.c:
case VT_VARIANT|VT_ARRAY|VT_BYREF: { IEnumVARIANT *iter;
hres = create_safearray_iter(V_ISBYREF(v.v) ? *V_ARRAYREF(v.v) : V_ARRAY(v.v), &iter);
hres = create_safearray_iter(V_ISBYREF(v.v) ? *V_ARRAYREF(v.v) : V_ARRAY(v.v), v.owned, &iter);
I think we shouldn't destroy the array if it's a reference. Does changing `v.owned` to `v.owned && !V_ISBYREF(v.v)` work for you?