i call SysFreeString(bstr) for bstr , the param[0] is equal to bstr , and has nothing to bstr . i release bstr , but param[0] still exist. what's more, when i make param[1].vt = VT_BSTR; param[1].bstrVal = bstr;, the problem disappears. so i think the problem has nothing with SysFreeString(bstr).