Taking the address of the pCheck argument in LoadEnvListener ctor gives the
address of the temporary on the stack/register itself, not the address of
LoadEnv's m_pCheck which is apparently what it thinks it's doing.

All that can be said about m_ppCheck is deferencing it inside the ctor will
give the value of pCheck for the duration of the ctor.  What happens later on
in subsequent method calls is pot luck, storing it and deferencing it later is
meaningless.

Presumably this worked because it's rare for the dereferenced m_ppCheck to end
up containing 0 at the wrong time. Right now in a debugging build the mail
merge dialog from print... when there are form fields in a document and "print
form field" is selected triggers a 0 in there post construction at some stage
or other, causing the dialog to never appear as the loading here never
completes.