A number of poorly written IE BHO's crash IE if ChromeFrame is the currently ...

chrome_frame/urlmon_moniker.cc

Index: chrome_frame/urlmon_moniker.cc
===================================================================
--- chrome_frame/urlmon_moniker.cc	(revision 74374)
+++ chrome_frame/urlmon_moniker.cc	(working copy)
@@ -81,14 +81,17 @@
   return thread_singleton_.Pointer()->Get();
 }
 
-void NavigationManager::RegisterThreadInstance() {
+void NavigationManager::RegisterThreadInstance(IWebBrowser2* web_browser2) {
   DCHECK(GetThreadInstance() == NULL);
+  DCHECK(web_browser2 != NULL);
   thread_singleton_.Pointer()->Set(this);
+  web_browser2_ = web_browser2;
 }
 
 void NavigationManager::UnregisterThreadInstance() {
   DCHECK(GetThreadInstance() == this);
   thread_singleton_.Pointer()->Set(NULL);
+  web_browser2_.Release();
 }
 
 /////////////////////////////////////////