_GUICtrlRichEdit_GetText crashes SyncToySetup

[Schuss]

The SyncToy 2.1 32-bit installer on XP Pro SP3 (tried multiple computers) crashes when _GUICtrlRichEdit_GetText attempts to read the Folder textbox control on the "Select Installation Folder" screen. I've reduced the problem to the following code that verifies the control handle is valid (agrees with AutoIt Window Info).

#Include <GuiRichEdit.au3>                          ; Installing SyncToySetupPackage_v21_x86.exe - SyncToy 2.1 (x86)
$h=ControlGetHandle('SyncToy 2','','RichEdit20W1')  ; Folder textbox control ("Select Installation Folder" screen)
MsgBox (0,"handle",$h)                              ; handle to control is always ok
msgbox(0,_GUICtrlRichEdit_GetText($h),@error)       ; @error=700 and MSI installer crashes:
    ; AppName: synctoysetup.exe  AppVer: 8.0.50727.42    ModName: riched20.dll  -- ModVer: 5.30.23.1230  Offset: 00018852

_GUICtrlRichEdit_GetText returns a null and @error=700

Note that it crashes in riched20.dll

Edited August 12, 2010 by Schuss