reference. The particular path seen was XFixes' ReplaceCursor() resulting in the sprite.current being freed, but then it getting accessed during the ChangeToCursor() that happens as a result of WindowHasNewCursor().