OK. I finally found a way to stop the crashing: https://gerrit.libreoffice.org/c/core/+/176037 Apparently, doing a dynamic_cast from a UNO reference to its base pointer is failing in two places so use static_cast for now. Patrick