The call to _CopyForWrite() invalidated the pointer previously assigned. There was also an unrelated null-pointer derefence situation in the copy constructor. Fixes #3074 and CID 610886 and CID 610887.