Ok, I was able to reproduce.
Look like, it's 2 my mistakes.

I set FreeKnownFolderDefinitionFields under "if" scope that check only first member.
However, FreeKnownFolderDefinitionFields is not need at all, because CoTaskMemFree + ptr to array free whole resourse.
Crash happened because I tried to free it twice.