diff --git a/dlls/shell32/shlview.c b/dlls/shell32/shlview.c
index 2c8b6bd8d5d..f815011a962 100644
--- a/dlls/shell32/shlview.c
+++ b/dlls/shell32/shlview.c
@@ -3806,6 +3806,9 @@ HRESULT WINAPI SHCreateShellFolderViewEx(CSFV *desc, IShellView **shellview)
     TRACE("sf=%p pidl=%p cb=%p mode=0x%08x parm=%p\n", desc->pshf, desc->pidl, desc->pfnCallback,
         desc->fvm, desc->psvOuter);
 
+    if (!desc->pshf)
+        return E_UNEXPECTED;
+
     *shellview = IShellView_Constructor(desc->pshf);
     if (!*shellview)
         return E_OUTOFMEMORY;
diff --git a/dlls/shell32/tests/shlview.c b/dlls/shell32/tests/shlview.c
index f5adae57ded..8603ddbfc40 100644
--- a/dlls/shell32/tests/shlview.c
+++ b/dlls/shell32/tests/shlview.c
@@ -1433,6 +1433,16 @@ static void test_SHCreateShellFolderViewEx(void)
         ok(refCount == 0, "refCount = %u\n", refCount);
     }
 
+if (0)
+{
+    /* Crashes on null shellfolder, on XP/2k3 */
+    memset(&csfv, 0, sizeof(csfv));
+    csfv.pshf = NULL;
+    psv = (void *)0xdeadbeef;
+    hr = SHCreateShellFolderViewEx(&csfv, &psv);
+    ok(hr == E_UNEXPECTED, "Got 0x%08x\n", hr);
+    ok(psv == NULL, "psv = %p\n", psv);
+}
     memset(&csfv, 0, sizeof(csfv));
     csfv.cbSize = sizeof(csfv);
     csfv.pshf = desktop;