Is it possible that the free does not fail for the functor itself but for a member variable (for instance a pointer which is freed in the destructor)?
Well, first of all, the place where it crashes looks like an attempt to invoke the destructor of functor_type - it's not inside the destructor yet. The out_buffer looks like it's freed. Besides, my boost::function object contains the result of bind() with smart pointers only. Still, I've got one little doubt... Consider a smart-ptr that can be implicitly converted to the pointee (CComPtr), and a function that looks like this: func1(IMyInterface *obj); CComPtr<IMyInterface> ptr = ...; function f = bind(&func1, ptr); The binder will store the smart pointer itself, converting it in the place of the actuall call, right?