The .NET Framework contains a Global Assembly Cache or GAC viewer. For the user's convenience this is a shell extension so that the user can view the GAC right from within Windows Explorer.
This .NET Framework dll contains a bug which causes its hosting process, Explorer.exe, to crash.
Follow the steps in the Steps to Reproduce section which shows that shfusion.dll (the GAC viewer) is causing memory corruption which leads to the crash of its hosting process, Explorer.exe.
The crash in Explorer.exe is caused by the way in which shfusion.dll (a part of the .NET Framework) is placing text on the clipboard. The problem is that shfusion.dll is calling "GlobalFree()" after calling "SetClipboardData()". Once SetClipboardData() is called the calling application no longer owns that memory and must not free the memory.
See Raymond Chen's article on this topic:
"You can't give away something that isn't yours"