SysFreeString causes GPF on Vista - why?!

void recurseFolders(IMAPIFolder *parent, BSTR& prefix, long parentid, SAFEARRAY *folders, VARIANT *result)
{
	if (folders==0) return;
	if (parent==0) return;
	SAFEARRAYBOUND aDim[2]; 
	long bnd;
	long bnd2;
	long idx;
	CComVariant v;
	HRESULT hr;
 
 
	IMAPITable *hierarchy;
	const GUID local_IID_IMAPITable = {0x00020301,0,0, {0xC0,0,0,0,0,0,0,0x46}};
	hr = parent->OpenProperty(PR_CONTAINER_HIERARCHY,&local_IID_IMAPITable,0,0,(IUnknown**)&hierarchy);
	if (hr!=S_OK) {
		v = L"Failed to open property table";
		v.Detach(result);
		return;
	}
	// and query for all the rows
	SizedSPropTagArray(4, cols) = {4, {PR_ENTRYID,PR_DISPLAY_NAME,PR_SUBFOLDERS,PR_CONTAINER_CLASS} };
	SRowSet *rows;
	hr = HrQueryAllRows(hierarchy,(SPropTagArray*)&cols, NULL, NULL, 0, &rows);
	hierarchy->Release();
	MAPIFreeBuffer(&cols);
	if (hr!=S_OK) {
		FreeProws(rows);
		v = L"Failed to query rows";
		v.Detach(result);
		return;
	}
	if (rows->cRows==0) {
		FreeProws(rows);
		v = L"No rows returned";
		v.Detach(result);
		return;
	}
	if (rows->aRow[0].cValues<4) {
		FreeProws(rows);
		v = L"Invalid number of properties returned";
		v.Detach(result);
		return;
	}
 
	if (SUCCEEDED(hr = SafeArrayGetUBound(folders,2,&bnd))) {
		hr = SafeArrayGetUBound(folders,1,&bnd2);
	}
	if (SUCCEEDED(hr)) {
		idx = bnd;
		bnd = bnd + rows->cRows+1;
		aDim[0].lLbound = 0; 
		aDim[0].cElements = (unsigned long)bnd;
		aDim[1].lLbound = 0; 
		aDim[1].cElements = (unsigned long)bnd2;
		hr = SafeArrayRedim(folders, aDim);
		if (SUCCEEDED(hr)) {
			//hr = SafeArrayLock(folders);
			if (FAILED(hr)) v = L"Failed to lock array";
		} else {
			v = L"Failed to allocate array";
		}
	} else {
		v=L"Failed to get bounds";
	}
	
	if (hr!=S_OK) {
		FreeProws(rows);
		v.Detach(result);
		return;
	}
 
	v.Detach(result);
 
	VARIANT vparentid;
	vparentid.vt=VT_I4;
	vparentid.lVal=parentid;
 
	for (unsigned int i=0; i<rows->cRows; i++)
	{
		BOOL subfolders = rows->aRow[i].lpProps[2].Value.b;
		IMAPIFolder *subf;
		ULONG subftype;
		hr = parent->OpenEntry(rows->aRow[i].lpProps[0].Value.bin.cb, (LPENTRYID)rows->aRow[i].lpProps[0].Value.bin.lpb, NULL, 0, &subftype, (IUnknown**)&subf);
		if (hr==S_OK)
		{
			if (subftype == MAPI_FOLDER)
			{
 
				CComBSTR fldrsep;
				fldrsep = _T("\\");
				CComBSTR fldrpath;
				CComBSTR fldrname;
				fldrpath=L"";
				fldrname=L"";
				fldrpath.Append(prefix);
				fldrpath.Append(fldrsep);
				fldrpath.Append(rows->aRow[i].lpProps[1].Value.lpszA);
				fldrname.Append(rows->aRow[i].lpProps[1].Value.lpszA);
				CComBSTR fldrtype;
				fldrtype=L"";
				if (rows->aRow[i].cValues>3) {
					if ((rows->aRow[i].lpProps[3].ulPropTag & 0xffff) == PT_STRING8) {
						fldrtype.Append(rows->aRow[i].lpProps[3].Value.lpszA);
					} else if ((rows->aRow[i].lpProps[3].ulPropTag & 0xffff) == PT_UNICODE) {
						fldrtype.Append(rows->aRow[i].lpProps[3].Value.lpszW);
					} else {
						fldrtype.Append(L"IPF.Note");
					}
				} else fldrtype.Append(L"Unknown");
				long arridx[2];
				CComVariant fn(L"");
				// Put folder name
				if (bnd2>=0) {
					fn=(BSTR)fldrname;
					arridx[0]=0;
					arridx[1]=idx;
					hr = SafeArrayPutElement(folders, arridx, &fn);
				}
				// Put folder type
				if (bnd2>0) {
					arridx[0]=1;
					arridx[1]=idx;
					fn=(BSTR)fldrtype;
					hr = SafeArrayPutElement(folders, arridx, &fn);
				}
				// Put parent path
				if (bnd2>1) {
					fn=prefix;
					arridx[0]=2;
					arridx[1]=idx;
					hr = SafeArrayPutElement(folders, arridx, &fn);
				}
				// Put parent id
				if (bnd2>2) {
					arridx[0]=3;
					arridx[1]=idx;
					hr = SafeArrayPutElement(folders, arridx, &vparentid);
				}
				if (subfolders) recurseFolders(subf,fldrpath.m_str,idx,folders,result);
				idx++;
			}
			subf->Release();
		}
	}
	FreeProws(rows);
}
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147: