What could cause a dynamic_cast to crash?...