Send to Mail Recipient Crashes Explorer

Question

Windows 10's explorer is crashing on: Right-Click file > Send To > Mail Recipient

Here's the application error:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="Application Error" /> 
      <EventID Qualifiers="0">1000</EventID> 
      <Level>2</Level> 
      <Task>100</Task> 
      <Keywords>0x80000000000000</Keywords> 
      <TimeCreated SystemTime="2017-10-04T11:40:02.739012900Z" /> 
      <EventRecordID>3694</EventRecordID> 
      <Channel>Application</Channel> 
      <Computer>pc777.lucky7.local</Computer> 
      <Security /> 
      </System>
    <EventData>
          <Data>explorer.exe</Data> 
          <Data>10.0.15063.608</Data> 
          <Data>b00723ab</Data> 
          <Data>ntdll.dll</Data> 
          <Data>10.0.15063.608</Data> 
          <Data>8274fd8b</Data> 
          <Data>c0000409</Data> 
          <Data>000000000009626f</Data> 
          <Data>1404</Data> 
          <Data>01d33d0542be8faf</Data> 
          <Data>C:\WINDOWS\explorer.exe</Data> 
          <Data>C:\WINDOWS\SYSTEM32\ntdll.dll</Data> 
          <Data>a071ec0e-a54b-4141-814b-82b016c07833</Data> 
          <Data /> 
          <Data /> 
      </EventData>
  </Event>

A crash dump can be downloaded here.

.....................
Loading unloaded module list
...................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(af0.2574): Security check failure or stack buffer overrun - code c0000409 (first/second chance not available)
ntdll!LdrpICallHandler+0xf:
00007ffe`d7aa626f cd29            int     29h

************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
0:004> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for JitV.dll - 
*** WARNING: Unable to verify timestamp for sppc.dll
*** ERROR: Module load completed but symbols could not be loaded for sppc.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for MSMAPI32.DLL - 
*** WARNING: Unable to verify timestamp for mapi32.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C2R64.dll - 
GetUrlPageData2 (WinHttp) failed: 12002.

DUMP_CLASS: 2

DUMP_QUALIFIER: 400

CONTEXT:  (.ecxr)
rax=0000000000000000 rbx=0000000000000000 rcx=000000000000000a
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=00007ffed7aa626f rsp=00000000031feab8 rbp=00000000031febf0
 r8=00000000031ff200  r9=00000000031febb0 r10=00007ffed7b4f534
r11=00007ffed7a10000 r12=00007ffed7a10000 r13=00007ffed7aa632e
r14=00000000031ff7b8 r15=00000000031ff6f0
iopl=0         nv up ei pl zr na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
ntdll!LdrpICallHandler+0xf:
00007ffe`d7aa626f cd29            int     29h
Resetting default scope

FAULTING_IP: 
ntdll!LdrpICallHandler+f
00007ffe`d7aa626f cd29            int     29h

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ffed7aa626f (ntdll!LdrpICallHandler+0x000000000000000f)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 000000000000000a
Subcode: 0xa FAST_FAIL_GUARD_ICALL_CHECK_FAILURE

PROCESS_NAME:  explorer.exe

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  000000000000000a

WATSON_BKT_PROCSTAMP:  b00723ab

WATSON_BKT_PROCVER:  10.0.15063.608

PROCESS_VER_PRODUCT:  Microsoft® Windows® Operating System

WATSON_BKT_MODULE:  ntdll.dll

WATSON_BKT_MODSTAMP:  8274fd8b

WATSON_BKT_MODOFFSET:  9626f

WATSON_BKT_MODVER:  10.0.15063.608

MODULE_VER_PRODUCT:  Microsoft® Windows® Operating System

BUILD_VERSION_STRING:  10.0.15063.246 (WinBuild.160101.0800)

MODLIST_WITH_TSCHKSUM_HASH:  1c63e1053be840a2d95fe7e35ee4cac3ecf6c9ed

MODLIST_SHA1_HASH:  5794374a82ea9aa65833b12c5743a8b6d471d369

NTGLOBALFLAG:  0

PROCESS_BAM_CURRENT_THROTTLED: 0

PROCESS_BAM_PREVIOUS_THROTTLED: 0

APPLICATION_VERIFIER_FLAGS:  0

DUMP_FLAGS:  94

DUMP_TYPE:  1

Things to note:

• On this workstation, both Windows 10 and Office 2016 are fully updated.
• It does this not matter what the Default Application for Email is (Mail, Outlook, and Thunderbird, have been set as default during testing --still crashes).
• The "Mail Recipient.MAPIMail" file on this workstation is identical to "Mail Recipient.MAPIMail" files on other workstations where this feature is working correctly.
• The registry at "Computer\HKEY_CLASSES_ROOT\mailto\shell\open\command" on this workstation is identical to other workstations where this feature is working.
• Each day, additional users are reporting this same issue. It seems like Windows 10 Auto-Updates are breaking this feature one workstation at a time as the auto-updates are getting auto-applied. It seems like the users who never reboot their computer are the ones not experiencing this issue (YET).

Things I've tried:

• partnersupport.microsoft.com

• outlook-tips.net

Background:

A couple of months ago I upgraded one of my user's Windows 10 workstation from Office 2010 Home and Business 32bit to Office Home and Business 2016 64bit. This Mail Recipient feature worked for a long while, then it started crashing Explorer around Thursday of last week.

Expected Behavior:

This user mails a lot of file attachments from Windows File Explorer, by:

1. Right-Clicking on one or more files she has highlighted in Internet Explorer.
2. Then goes to the sub-menu "Send To" and then clicks "Mail Recipient"

After this, she expect these things to happen:

1. Outlook 2016 should compose a new email The new email will have all the attachments attached (that she highlighted earlier).
2. The subject line of the new email should contain the list of file attachments that are attached to the email.

I appreciate any additional suggestions not included in the links above.