Windows Explorer crashes when subscribing to structure changed events on the RootElement #7

Registering for StructureChangedEvents on the RootElement, with the TreeScope of Children will cause Windows Explorer to crash intermittently. I have been able to reliably cause a crash by either navigating between network drives in Windows Explorer, or more reliably by right clicking the desktop -> Personalize -> Desktop Background and clicking the drop down "Picture Position". The crash occurs at the same location every time no matter how it is reproduced in Windows Explorer, in DUI70.dll, with the same offset every time, with an AccessViolationException. When attached to Explorer.exe in visual studio, I was able to download the public symbols for DUI70.dll and when the exception occured the function that DUI70.dll was currently executing was "RaiseStructureChangeEvent". I was only able to view function headers and the rest of disassembly.

Is anyone else able to reproduce this and have some insight as to what may be causing it? This was tested on Windows 7. We do not have any Windows 8 or Windows 10 machines that are currently in use, so I am not sure if they can be reproduced on those operating systems.

namespace ConsoleApplication1
{
    class Program
    {
        static void Main(string[] args)
        {
            SubscribeForStructureChanged();
        }

        public static void SubscribeForStructureChanged()
        {
            try
            {
                Automation.AddStructureChangedEventHandler(
                    AutomationElement.RootElement,
                    TreeScope.Children,
                    new StructureChangedEventHandler(OnStructureChanged));

                while(true)
                {
                    System.Threading.Thread.Yield();
                }
            }
            catch (ElementNotAvailableException) { }
            catch (Exception e)
            {
                Console.WriteLine(e);
            }                   
        }

        private static void OnStructureChanged(object sender, StructureChangedEventArgs e)
        {
            return;
        }
    }
}