I got problem recently with curl, my app crashes after sending request inside destroy_async_data function. When freeing data with free(async->hostname) it crashed because didn’t pass msvcrt heap check.
After 1 day debugging, contemplating and day dreaming finally I got this mailing list thread which exactly same as my problem. Apparently this is quite common problem and not curl specific, and trust me it is 100% my fault because I forgot to follow simple rule. The rule is always use same CRT for your modules, but actually I need to revisit this rule.