I realized the browse_info's pidlRoot is accessed later in BrsFolder_OnSetExpanded when BFFM_SETEXPANDED/BFFM_SETSELECTIONA/W is sent, but when I re-used test_selection's selection_callback and selected_folder_pidl variable, native also crashes with access violation on the tests with FALSE wparam and non-zero lparams. The affected applications don't send these messages.