AddressOf for Class Methods (and other VTable exploration)?

[Elroy]

Okay, this one is purely for my own edification. I feel like I've seen this, but I can't put my fingers on it.

And, if you guys are willing to play along, it'll be nice for me to get some of these concepts under my belt.

Also, thanks to Ben for spurring my thoughts on this subject.

Ok, simple question. Let's say we've got the following very simplistic class module:

Option Explicit

Public Sub Test(ByVal arg1 As Long, ByVal arg2 As Long, ByVal arg3 As Long, ByVal arg4 As Long)
    MsgBox CStr(arg1) & " " & CStr(arg2) & " " & CStr(arg3) & " " & CStr(arg4)
End Sub

And, let's further say that I've instantiated this class with something like the following:

    Dim c As Class1
    Set c = New Class1

And I'll also throw in a nice function suggested by Dex:

Option Explicit
'
Private Declare Function GetMem4 Lib "msvbvm60" (Src As Any, Dst As Any) As Long
'

Private Function DeRef(ByVal Address As Long) As Long
    GetMem4 ByVal Address, DeRef
End Function

And we can throw in these declarations as well, just in case they're needed:

Private Declare Function CallWindowProc Lib "user32.dll" Alias "CallWindowProcA" (ByVal lpPrevWndFunc As Long, ByVal hwnd As Long, ByVal msg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
Private Declare Function DispCallFunc Lib "oleaut32" (ByVal PPV As Long, ByVal oVft As Long, ByVal cc As Long, ByVal rtTYP As VbVarType, ByVal paCNT As Long, ByVal paTypes As Long, ByVal paValues As Long, ByRef fuReturn As Variant) As Long
Private Declare Sub CopyMemory Lib "kernel32.dll" Alias "RtlMoveMemory" (ByRef Destination As Any, ByRef Source As Any, ByVal Length As Long)
Private Declare Function VBObjPtr Lib "msvbvm60.dll" Alias "VarPtr" (ByVal pObj As IUnknown) As Long

Now, here's the question: How would one go about getting the address of that "Test" function, and then call it with that address?

I've tried a few different things, but all I do is keep crashing the VB6 IDE.

Thanks,
Elroy