Office 2007 Enterprise Setup crash

Trying to reproduce CORE-9171 (with set condition * first always and doing the gflags thing) I get following:

...
(../../win32ss/user/ntuser/caret.c:94) err: Not the same caret window!
(../../win32ss/user/ntuser/caret.c:94) err: Not the same caret window!
fixme../../dll/win32/msxml3/pi.c:290) created dummy map for <?xml ?>
Assertion 'FALSE' failed at ../../lib/rtl/heappage.c line 1736

Entered debugger on embedded INT3 at 0x001b:0x7c92ca82.
kdb:> bt
bt
Eip:
<ntdll.dll:ca83> :0 (DbgBreakPoint)
Frames:
<ntdll.dll:39ce0> lib/rtl/heappage.c:1736 (RtlpPageHeapAllocate)
<ntdll.dll:3a277> lib/rtl/heappage.c:2001 (RtlpPageHeapReAllocate)
<ntdll.dll:3af02> lib/rtl/heapdbg.c:207 (RtlDebugReAllocateHeap)
<ntdll.dll:223ec> lib/rtl/heap.c:2568 (RtlReAllocateHeap)
<msvcrt.dll:27b8> lib/sdk/crt/wine/heap.c:322 (realloc)
<msxml3.dll:cbb66> lib/3rdparty/libxml2/buf.c:806 (xmlBufResize)
<msxml3.dll:cbcc9> lib/3rdparty/libxml2/buf.c:870 (xmlBufAdd)
<msxml3.dll:c6e24> lib/3rdparty/libxml2/xmlIO.c:3479 (xmlOutputBufferWrite)
<msxml3.dll:c7444> lib/3rdparty/libxml2/xmlIO.c:3738 (xmlOutputBufferWriteString)
<msxml3.dll:8de03> lib/3rdparty/libxml2/xmlsave.c:1051 (xmlNodeDumpOutputInternal)
<msxml3.dll:8e081> lib/3rdparty/libxml2/xmlsave.c:825 (xmlNodeListDumpOutput)
<msxml3.dll:8df11> lib/3rdparty/libxml2/xmlsave.c:1074 (xmlNodeDumpOutputInternal)
<msxml3.dll:8e081> lib/3rdparty/libxml2/xmlsave.c:825 (xmlNodeListDumpOutput)
<msxml3.dll:8df11> lib/3rdparty/libxml2/xmlsave.c:1074 (xmlNodeDumpOutputInternal)
<msxml3.dll:8e3b6> lib/3rdparty/libxml2/xmlsave.c:2391 (xmlNodeDumpOutput)
<msxml3.dll:8e580> lib/3rdparty/libxml2/xmlsave.c:2284 (xmlBufNodeDump)
<msxml3.dll:8e5f7> lib/3rdparty/libxml2/xmlsave.c:2220 (xmlNodeDump)
<msxml3.dll:42c29> dll/win32/msxml3/node.c:871 (node_get_xml)
<msxml3.dll:22580> dll/win32/msxml3/element.c:1076 (domelem_get_xml)
<OSETUP.DLL:189a88>--- Press q to abort, any other key to continue —

<OSETUP.DLL:18b036>
<OSETUP.DLL:17f289>
<OSETUP.DLL:13331e>
<OSETUP.DLL:12e695>
<OSETUP.DLL:13187e>
<OSETUP.DLL:1a1fcf>
<OSETUP.DLL:126ee0>
<OSETUP.DLL:1a824e>
<OSETUP.DLL:1a897b>
<OSETUP.DLL:1ae8f7>
<OSETUP.DLL:23a582>
<OSETUP.DLL:23a61a>
<OSETUP.DLL:23a7cc>
<user32.dll:587cb> win32ss/user/user32/windows/message.c:1490 (IntCallWindowProcW)
<user32.dll:58b5d> win32ss/user/user32/windows/message.c:1730 (IntCallMessageProc)
<user32.dll:592d0> win32ss/user/user32/windows/message.c:1983 (DispatchMessageW)
<OSETUP.DLL:1a275f>
<OSETUP.DLL:132900>
<OSETUP.DLL:1267b2>
<setup.exe:134f4>
<setup.exe:ca00>--- Press q to abort, any other key to continue —

<setup.exe:f64b>
<kernel32.dll:fbe3>
<00000000>

a cont gives me a pagefault:
Entered debugger on first-chance exception (Exception Code: 0xc0000005) (Page Fault)
Memory at 0x11D6F000 could not be written: Page not present.
kdb:> bt
bt
Eip:
<ntdll.dll:3ed78>
Frames:
<ntdll.dll:39dfa>
<ntdll.dll:3a277>
<ntdll.dll:3af02>
<ntdll.dll:223ec>
<msvcrt.dll:27b8>
<msxml3.dll:cbb66>
<msxml3.dll:cbcc9>
<msxml3.dll:c6e24>
<msxml3.dll:c7444>
<msxml3.dll:8de03>
<msxml3.dll:8e081>
<msxml3.dll:8df11>
<msxml3.dll:8e081>
<msxml3.dll:8df11>
<msxml3.dll:8e3b6>
<msxml3.dll:8e580>
<msxml3.dll:8e5f7>
<msxml3.dll:42c29>
<msxml3.dll:22580>
<OSETUP.DLL:189a88>--- Press q to abort, any other key to continue —

<OSETUP.DLL:18b036>
<OSETUP.DLL:17f289>
<OSETUP.DLL:13331e>
<OSETUP.DLL:12e695>
<OSETUP.DLL:13187e>
<OSETUP.DLL:1a1fcf>
<OSETUP.DLL:126ee0>
<OSETUP.DLL:1a824e>
<OSETUP.DLL:1a897b>
<OSETUP.DLL:1ae8f7>
<OSETUP.DLL:23a582>
<OSETUP.DLL:23a61a>
<OSETUP.DLL:23a7cc>
<user32.dll:587cb>
<user32.dll:58b5d>
<user32.dll:592d0>
<OSETUP.DLL:1a275f>
<OSETUP.DLL:132900>
<OSETUP.DLL:1267b2>
<setup.exe:134f4>
<setup.exe:ca00>--- Press q to abort, any other key to continue —

<setup.exe:f64b>
<kernel32.dll:fbe3>
<00000000>