crash during gDirServiceProvider destruction

I'm working on an app running under Win7 that embeds Gecko and I've run 
into a crash during XRE_TermEmbedding that I'm trying to resolve.  The 
stack track for the crash is:

xul.dll!nsCOMPtr<nsIDirectoryServiceProvider>::~nsCOMPtr<nsIDirectoryServiceProvider>() 

xul.dll!nsXREDirProvider::~nsXREDirProvider()
xul.dll!nsXREDirProvider::`scalar deleting destructor'()
xul.dll!XRE_TermEmbedding()

The actual line of code that crashes is in ~nsCOMPtr in nsCOMPtr.h:
              NSCAP_RELEASE(this, mRawPtr);

because Visual Studio is convinced that mRawPtr points to an invalid 
memory location (0xFEEEFEEE in this case) and I tend to agree.

The nsCOMPtr object in question is gDirServiceProvider which 
XRE_TermEmbedding deletes.

  From looking at XRE_TermEmbedding, I can't tell what the right fix is 
-- perhaps a change to nsXREDirProvider::DoShutdown, or a change in the 
order of the function calls?  Or most likely, I need to change something 
in my code.  I could use a hand with this.

I can reproduce this by calling 
nsIWebNavigation::LoadURI("http://google.com") and then calling
nsIWebNavigation::Stop(nsIWebNavigation::STOP_ALL) (and the rest of the 
cleanup done embedding/tests/winEmbed/winEmbed.cpp does in 
WebBrowserChromeUI::Destroy) before the URI has been loaded.

I can also reproduce this by waiting until the URI is all the way loaded 
(or at least I receive the nsIWebProgressListener::OnStateChange call 
with STATE_STOP | STATE_IS_NETWORK | STATE_IS_WINDOW with status 0.

It crashes whether I pass nsnull as the aAppDirProvider argument to 
XRE_InitEmbedding or my own nsIDirectoryServiceProvider implementation.

I've have the log from "all:5" with my own nsIDirectoryServiceProvider 
implementation but it's too big to get to the list unmoderated (75k).

I'm not sending a simple test case because I don't have one.  I'll 
create one if necessary but I hope there's enough here to go on.

Thanks much for your help.

-DB