[SHELL32] regression of r72808 - explorer file-browser leaks one "user object" per directory change

ros gcc dbg
When browsing with explorers file-browser, we leak one "user object" (observable via column in taskmgr) whenever we change a directory.
Those accumulate over time and never get freed.

[SHELL32] r72808 is the guilty rev.
see UserObjectLeakRegressionTest.txt