We experience crashes when using lambda expression for RoutedEvent handlers. The crash occurs under the following conditions:

1. The lambda expression contains captured variables
2. Inside the handler there's a code to add another event handler (using += etc)
3. Accessing a captured variable after the previous addition of event handler

Sample code:

auto p = std::make_shared<Data>();
elem->Loaded += [p](auto sender, const auto& ea) {
   auto elem = DynamicCast<FrameworkElement*>(sender);
   elem->MouseRightButtonUp += ... // Add event handler
   p->DoSomething();  // Crash here when accessing p (its value becomes invalid)
}

It seems that the cause is the use of HashMap to store the element's event handlers. The current HashMap implementation will reallocate the handlers at some point when resizing is necessary, and the executing handler will get destroyed before finishing its execution (the lambda member variables are also destroyed).