Crash during CoUninitialize seemingly due to my event sink

The crash (developing/running on Vista, using COM without ATL/MFC) appears to be during CoUninitialize (at some point after the event sink object gets deleted):

First-chance exception at 0x7783cb3f (oleaut32.dll) in myapp.exe: 0xC0000005: Access violation reading location 0xfeeefef6.
First-chance exception at 0x75f242eb (kernel32.dll) in myapp.exe: 0x80010108: The object invoked has disconnected from its clients.

At startup, I connect to a local out-of-process com automation server, and create an event sink which I Advise() to the com server.

When my app is exiting, I:
"      UnAdvise() my sink
"      Release() my sink (the refcount is 3 when entering this function)
"      Release() the smart com object pointer
"      CoUninitialize()

If I comment out my event sink (i.e. never create it), then I dont get the crash.
Or, if I artificially bump up the refcount on my sink object by 1 so it doesnt get deleted, the crash still happens

The stack looks something like this:
                ntdll.dll!_DbgBreakPoint@0()    
                ntdll.dll!_RtlReportException@12()  + 0x51 bytes              
                ole32.dll!SilentlyReportExceptions()  + 0x79 bytes            
                ole32.dll!ServerExceptionFilter()  + 0x24 bytes  
                ole32.dll!AppInvokeExceptionFilterWithMethodAddress()  + 0x11 bytes              
                ole32.dll!AppInvokeExceptionFilter()  + 0x1a bytes          
                ole32.dll!FinishShutdown()  + 0x3692b bytes      
                msvcrt.dll!@_EH4_CallFilterFunc@8()  + 0x12 bytes        
                msvcrt.dll!__except_handler4_common()  + 0x87 bytes              
                ole32.dll!__except_handler4()  + 0x20 bytes      
                ntdll.dll!ExecuteHandler2@20()  + 0x26 bytes    
                ntdll.dll!ExecuteHandler@20()  + 0x24 bytes      
                ntdll.dll!_KiUserExceptionDispatcher@8()  + 0xf bytes  
                oleaut32.dll!CStubWrapper::Disconnect()  + 0x25 bytes
                ole32.dll!CStdMarshal::DisconnectSrvIPIDs()  + 0xcd bytes          
                ole32.dll!CStdMarshal::Disconnect()  - 0x4a77 bytes        
                ole32.dll!DisconnectSwitch()  + 0x16 bytes          
                ole32.dll!CStdMarshal::DisconnectAndRelease()  + 0x2e bytes  
                ole32.dll!COIDTable::ThreadCleanup()  - 0x27b8b bytes
                ole32.dll!FinishShutdown()  + 0x40 bytes              
                ole32.dll!ApartmentUninitialize()  + 0x58 bytes  
                ole32.dll!wCoUninitialize()  - 0x13953 bytes        
                ole32.dll!_CoUninitialize@0()  + 0x1b2 bytes      
                myapp.exe!CHsw::Close()  Line 134 + 0x8 bytes               C++Start Free Trial