Jacek Caban (@jacek) commented about dlls/mshtml/oleobj.c:
if(!ref) { if(This->doc_node) {
This->doc_node->doc_obj = NULL;
IHTMLDOMNode_Release(&This->doc_node->node.IHTMLDOMNode_iface);
/* Protect against re-entry by grabbing it here */
This->ref++;
Please avoid it. You may just fully detach document object early, before releasing and uninitializing window and document node to be sure that we don't reenter the destructor. It could also simplify handling of skipping mutation events.