Hm... There's only a default destructor, so that rules that out. So, it may be a red herring to be trying to find fault in this reference counting; judging by the error given, it's crashing when trying to read ReferenceCounter, rather than triggering the assertion. So, it's either someone obviously is trying to use the automatically freed resource, or is trying to access something that was freed through some other means.
A stack trace and full error output would be desired. However, is it possible for you to place debug printing functions that don't depend on any state tracked by your code (like using std::cerr or std::wcerr), and have it output something like "IGUIStaticText constructed at (memory address)" on construction and reference increments, and "IGUIStaticText dropped at (memory address)" on calls to drop()? The (memory address) placeholder would be the value held by the this pointer, and if it doesn't dereference the this pointer for local variables or a vtable, it may manage to output the data without crashing, though the erroneous one would be undefined behavior, but it may still work for your platform.
If all goes to plan, you can count the number of times that a message is output for incrementing, and the number of times that a message is output for decrementing. If the two messages are equal in volume, we're barking up the wrong tree.