http://bugs.winehq.org/show_bug.cgi?id=11746 may explain a few mysterious wineserver crashes I saw a few weeks ago.
Anyone feel like diving in to this one? It's probably a rat's nest of twisty linked lists, and a node isn't getting removed properly from all the lists it's in when it's freed, or something.