Comment 56 for bug 599837

After the crash, in the debugger, can you try to see what's in memory near the address pointed to by eax ?
If I recall from a previous company when I was working with MSVC, there's a "view memory" window, and you can drag/drop an address on it, so it should show what's there. It'd help a lot if you can make a screenshot of that window showing the data before and after the address in eax, as well as giving the address in eax.
Based on the dissassembly, I'm now suspecting some kind of off by one on the subtitle text, even if valgrind doesn't find one here.
Thanks