Just saw something and maybe you can clarify.

You are using CopyMemory with the WM_NOTIFY message. That message specifically defines the lParam as a NMHDR structure. That structure only contains 3 Longs, not 8. This could be the cause of your crashes.