The main reason for the crash is that critical section is not
initialized before Lock is called.
In order to fix that you need to call _AtlInitialConstruct() method.
Here is the fixed method from the ProtocolCF.inl
template <class Factory, class Protocol, class FactoryComObject>
inline HRESULT CMetaFactory<Factory, Protocol, FactoryComObject>::
	CreateInstance(Factory** ppObj)
{
	ATLASSERT(ppObj != 0);
	if (!ppObj)
	{
		return E_POINTER;
	}
	HRESULT hr = E_OUTOFMEMORY;
	void* pv = static_cast<void*>(CreatorClass::CreateInstance);
	FactoryComObject* p = 0;
	ATLTRY(p = new FactoryComObject(pv))
	if (p != NULL)
	{
		p->SetVoid(pv);
		p->InternalFinalConstructAddRef();
		hr = p->_AtlInitialConstruct();
		hr = p->FinalConstruct();
		p->InternalFinalConstructRelease();
		if (FAILED(hr))
		{
			delete p;
			p = 0;
		}
	}
	*ppObj = p;
	return hr;
}
Best regards,
Valentin Ivanov.