Or is it intentional that `CreateInstance()` should still succeed when creating something that doesn't implement `ISpObjectWithToken`?
Yes, `IspObjectToken::SetObjectToken()` should only be called if it is available.
Also, it seems that in the happy path you call `QueryInstance()` twice and `Release()` only once, which would mean that you return a pointer with refcount 2. I don't think that's intended?
Good catch, fixed.