I think (not sure at all) that the problem was that at the end _GetAutoFmtNameLst(), destructor ~ImpAutoFmtNameListLoader for aTmp is called and must destroy (i don't know how) pLst vector
239 void ShellResource::_GetAutoFmtNameLst() const
241 std::vector<String>* pLst(pAutoFmtNameLst);
242 pLst = new std::vector<String>;
244 ImpAutoFmtNameListLoader aTmp( *pLst );
Again, I'm not sure at all of this.
So I tried to find a way to avoid ImpAutoFmtNameListLoader. I'm waiting confirmation that behaviour is ok but for the moment, I can say that, with this patch, it doesn't crash and the autocorrect seems to work.