shell32: try to guess the working directory in the run dialog

[Juan Lang]

> I suppose it is possible for the string to not be null-terminated if
> the command line ends in a backslash. I'll fix that and resend.

It's more probable than that, unless I'm missing something.  You
allocate result:
+    result = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY,
sizeof(WCHAR)*strlenW(cmdline));

set dest to result:
+    src = cmdline;
+    dest = result;

and copy src to dest, character by character:
+    while (*src)
+    {
+        *dest = *src;
where do you NULL-terminate dest?  Every backslash that's encountered
will result in GetFileAttributesW being called on a
non-NULL-terminated string, unless I'm missing something obvious.
--Juan