I just found a new way to workaround this problem with the state being replaced.

The attached patch introduces a new field in the internal session
structure to keep track of the currently cached session.
With this change the invalid memory access is gone and the Schannel
Credential handle (session) is still freed if the connection could not
be established. (This was the original reason for the cleanup code in
Curl_schannel_shutdown.)

-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html