I found the reason: You delete or Release() the pointer at some point, but you don't invalidate it.
Commenting out the code accessing m_pTreeTop around line 640 in classbrowserbuilderthread.cpp fixes the crash. Thus, the first logical conclusion is that the pointer is null.
However, adding a check for null-ness does not fix the crash. Ergo: the pointer in non-null and non-valid.
Find a delete without m_pTreeTop = 0, or a Release() without, and you have your bug.