TLB 4.2.2 Vista 64 explorer.exe crashes

This one happened just after a new e-mail was detected

Code:

Microsoft (R) Windows Debugger  Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [H:\Test\WER9E78.tmp.mdmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Symbol search path is: srv*G:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: srv*G:\Symbols*http://msdl.microsoft.com/download/symbols
Windows Vista Version 6000 MP (4 procs) Free x64
Product: WinNt, suite: SingleUserTS
Debug session time: Thu Nov  1 16:19:14.000 2007 (GMT-4)
System Uptime: 0 days 4:51:13.505
Process Uptime: 0 days 0:01:52.000
...................................................................................................................................................................
Loading unloaded module list
...............
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(f9c.e24): Access violation - code c0000005 (first/second chance not available)
ntdll!NtWaitForMultipleObjects+0xa:
00000000`77c4082a c3              ret
0:035> kd: Reading initial command '!analyze -v; q'
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for tlb.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for mailmon.dll -

FAULTING_IP:
+54fc483
00000000`054fc483 4a8b1409        mov     rdx,qword ptr [rcx+r9]

EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000054fc483
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 000007ff09440f88
Attempt to read from address 000007ff09440f88

DEFAULT_BUCKET_ID:  BAD_INSTRUCTION_PTR

PROCESS_NAME:  explorer.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

READ_ADDRESS:  000007ff09440f88

FAILED_INSTRUCTION_ADDRESS:
+54fc483
00000000`054fc483 4a8b1409        mov     rdx,qword ptr [rcx+r9]

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

IP_ON_HEAP:  00000000054c8676
The fault address in not in any loaded module, please check your build's rebase
log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may
contain the address if it were loaded.

FRAME_ONE_INVALID: 1

LAST_CONTROL_TRANSFER:  from 00000000054c8676 to 00000000054fc483

FOLLOWUP_IP:
tlb!SelfInstall+13ecbb
00000001`801c351b eb18            jmp     tlb!SelfInstall+0x13ecd5 (00000001`801c3535)

SYMBOL_STACK_INDEX:  f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: tlb

IMAGE_NAME:  tlb.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  46e6f4f9

FAULTING_THREAD:  0000000000000e24

PRIMARY_PROBLEM_CLASS:  BAD_INSTRUCTION_PTR

BUGCHECK_STR:  APPLICATION_FAULT_BAD_INSTRUCTION_PTR_STACK_CORRUPTION_CODE_RUNNING_ON_STACK

SYMBOL_NAME:  tlb!SelfInstall+13ecbb

STACK_COMMAND:  ~35s; .ecxr ; kb

FAILURE_BUCKET_ID:  X64_APPLICATION_FAULT_BAD_INSTRUCTION_PTR_STACK_CORRUPTION_CODE_RUNNING_ON_STACK_BAD_IP_tlb!SelfInstall+13ecbb

BUCKET_ID:  X64_APPLICATION_FAULT_BAD_INSTRUCTION_PTR_STACK_CORRUPTION_CODE_RUNNING_ON_STACK_BAD_IP_tlb!SelfInstall+13ecbb

Followup: MachineOwner
---------

quit:

HTH