Only appears to get noticed on one machine in the office, and not entirely sure what configuration that has set in order to show! Anyway...
In the get, it allocates enough bytes to hold the text range returned by Scintilla. However it does not allocate enough to hold the null terminator character that Scintilla appends. In Scintilla, Editor.cxx, line 6188 (case SCI_GETTEXTRANGE) before it returns
it terminates the buffer.
When this buffer is freed in the get accessor, the heap corruption is spotted.