A simple bug this time, in the scriptany addon. CScriptAny::Store() and CScriptAny::operator=() both do asITypeInfo::AddRef() on the type of object stored, but only if the object stored is not null. CScriptAny::FreeObject() on the other hand always Release()s the asITypeInfo regardless of whether the value stored was null. So storing null pointers in any objects will eat references on asITypeInfo and eventually crash.