[Bug 5658] Crash with VariantChangeType()