EVALUATION

First, the crash is caused by the calls to RegCloseKey(swKey) in kernel.cpp;  swKey is a CRegKey class, and it's destructor will call RegCloseKey already.  So these multiple calls to the same swKey in results in calling RegCloseKey with key that is already closed, and caused the crash.

But fixing this does not fix the crash :(   It now crash at the call on pDlg->DoModal() in kernel.cpp.  That in turns call into CDialogImplBaseT< TBase >::StartDialogProc, and crash inside the ATL code.

I tried to comment out pDlg->DoModal() in kernel.cpp, which will cause it to not show any download dialog, then there is no more crash.

I will try to Disable the download dialog for the small headless JVM in the browser for plugin2, and see if this will workaround the problem.