Fixed out-of-bound access to array, which would cause a crash later.

And the crash was caused in a not-so-obvious way that it was near
impossible to link it to the cause.  I had to resort to full inspection
of how the array was accessed in various methods.

sc/source/ui/inc/viewdata.hxx

@@ -236,6 +236,7 @@ private:
     SC_DLLPRIVATE void          CreateTabData( SCTAB nNewTab );
     SC_DLLPRIVATE void          CreateTabData( std::vector< SCTAB >& rvTabs );
     SC_DLLPRIVATE void          CreateSelectedTabData();
+    SC_DLLPRIVATE void          EnsureTabDataSize(size_t nSize);
 
 public:
                     ScViewData( ScDocShell* pDocSh, ScTabViewShell* pViewSh );

sc/source/ui/view/viewdata.cxx

@@ -1450,6 +1450,15 @@ void ScViewData::CreateSelectedTabData()
             CreateTabData( i );
 }
 
+void ScViewData::EnsureTabDataSize(size_t nSize)
+{
+    if (nSize >= maTabData.size())
+    {
+        size_t n = nSize - maTabData.size() + 1;
+        maTabData.insert(maTabData.end(), n, NULL);
+    }
+}
+
 void ScViewData::SetTabNo( SCTAB nNewTab )
 {
     if (!ValidTab(nNewTab))
@@ -2758,7 +2767,10 @@ void ScViewData::ReadUserDataSequence(const uno::Sequence <beans::PropertyValue>
                         uno::Sequence<beans::PropertyValue> aTabSettings;
                         if (aAny >>= aTabSettings)
                         {
-                            maTabData[nTab] = new ScViewDataTable;
+                            EnsureTabDataSize(nTab + 1);
+                            if (!maTabData[nTab])
+                                maTabData[nTab] = new ScViewDataTable;
+
                             bool bHasZoom = false;
                             maTabData[nTab]->ReadUserDataSequence(aTabSettings, *this, nTab, bHasZoom);
                             aHasZoomVect[nTab] = bHasZoom;