IEnumConnections->Next method crashes if optional pointer to the number of fetched items is not provided

void crash6( IQTCrashPtr qtObject )
{
	IConnectionPointPtr connectionPoint;
	IConnectionPointContainerPtr( qtObject )->FindConnectionPoint( __uuidof( IQTCrashEvents ), &connectionPoint );

	IEnumConnectionsPtr connections;
	connectionPoint->EnumConnections( &connections );

	CONNECTDATA connectionData = { 0, 0 };
	while( connections->Next( 1, &connectionData, 0 ) == S_OK) // crash here
	{
		if( connectionData.pUnk )
			connectionData.pUnk->Release();
	}
}