diff --git a/dlls/jscript/engine.c b/dlls/jscript/engine.c
index 15f71bd3f50..349f932d68d 100644
--- a/dlls/jscript/engine.c
+++ b/dlls/jscript/engine.c
@@ -295,8 +295,7 @@ void scope_release(scope_chain_t *scope)
     heap_free(scope);
 }
 
-HRESULT create_exec_ctx(script_ctx_t *script_ctx, jsdisp_t *var_disp,
-        BOOL is_global, exec_ctx_t **ret)
+HRESULT create_exec_ctx(script_ctx_t *script_ctx, BOOL is_global, exec_ctx_t **ret)
 {
     exec_ctx_t *ctx;
 
@@ -308,9 +307,6 @@ HRESULT create_exec_ctx(script_ctx_t *script_ctx, jsdisp_t *var_disp,
     ctx->is_global = is_global;
     ctx->ret = jsval_undefined();
 
-    jsdisp_addref(var_disp);
-    ctx->var_disp = var_disp;
-
     script_addref(script_ctx);
     ctx->script = script_ctx;
 
@@ -323,8 +319,6 @@ void exec_release(exec_ctx_t *ctx)
     if(--ctx->ref)
         return;
 
-    if(ctx->var_disp)
-        jsdisp_release(ctx->var_disp);
     if(ctx->script)
         script_release(ctx->script);
     jsval_release(ctx->ret);
@@ -587,7 +581,7 @@ static HRESULT interp_var_set(script_ctx_t *ctx)
     TRACE("%s\n", debugstr_w(name));
 
     val = stack_pop(ctx);
-    hres = jsdisp_propput_name(ctx->call_ctx->exec_ctx->var_disp, name, val);
+    hres = jsdisp_propput_name(ctx->call_ctx->variable_obj, name, val);
     jsval_release(val);
     return hres;
 }
@@ -2390,6 +2384,8 @@ OP_LIST
 
 static void release_call_frame(call_frame_t *frame)
 {
+    if(frame->variable_obj)
+        jsdisp_release(frame->variable_obj);
     if(frame->this_obj)
         IDispatch_Release(frame->this_obj);
     if(frame->scope)
@@ -2536,7 +2532,7 @@ static HRESULT bind_event_target(script_ctx_t *ctx, function_code_t *func, jsdis
 }
 
 static HRESULT setup_call_frame(exec_ctx_t *ctx, bytecode_t *bytecode, function_code_t *function, scope_chain_t *scope,
-        IDispatch *this_obj)
+        IDispatch *this_obj, jsdisp_t *variable_obj)
 {
     call_frame_t *frame;
 
@@ -2572,6 +2568,8 @@ static HRESULT setup_call_frame(exec_ctx_t *ctx, bytecode_t *bytecode, function_
         frame->this_obj = to_disp(ctx->script->global);
     IDispatch_AddRef(frame->this_obj);
 
+    frame->variable_obj = jsdisp_addref(variable_obj);
+
     frame->exec_ctx = ctx;
 
     frame->prev_frame = ctx->script->call_ctx;
@@ -2580,7 +2578,7 @@ static HRESULT setup_call_frame(exec_ctx_t *ctx, bytecode_t *bytecode, function_
 }
 
 HRESULT exec_source(exec_ctx_t *ctx, bytecode_t *code, function_code_t *func, scope_chain_t *scope,
-        IDispatch *this_obj, jsval_t *ret)
+        IDispatch *this_obj, jsdisp_t *variable_obj, jsval_t *ret)
 {
     jsval_t val;
     unsigned i;
@@ -2599,7 +2597,7 @@ HRESULT exec_source(exec_ctx_t *ctx, bytecode_t *code, function_code_t *func, sc
         if(func->funcs[i].event_target)
             hres = bind_event_target(ctx->script, func->funcs+i, func_obj);
         else
-            hres = jsdisp_propput_name(ctx->var_disp, func->funcs[i].name, jsval_obj(func_obj));
+            hres = jsdisp_propput_name(variable_obj, func->funcs[i].name, jsval_obj(func_obj));
         jsdisp_release(func_obj);
         if(FAILED(hres))
             return hres;
@@ -2609,13 +2607,13 @@ HRESULT exec_source(exec_ctx_t *ctx, bytecode_t *code, function_code_t *func, sc
         if(!ctx->is_global || !lookup_global_members(ctx->script, func->variables[i], NULL)) {
             DISPID id = 0;
 
-            hres = jsdisp_get_id(ctx->var_disp, func->variables[i], fdexNameEnsure, &id);
+            hres = jsdisp_get_id(variable_obj, func->variables[i], fdexNameEnsure, &id);
             if(FAILED(hres))
                 return hres;
         }
     }
 
-    hres = setup_call_frame(ctx, code, func, scope, this_obj);
+    hres = setup_call_frame(ctx, code, func, scope, this_obj, variable_obj);
     if(FAILED(hres))
         return hres;
 
diff --git a/dlls/jscript/engine.h b/dlls/jscript/engine.h
index cd4051f26be..55ce72a8f17 100644
--- a/dlls/jscript/engine.h
+++ b/dlls/jscript/engine.h
@@ -199,6 +199,7 @@ typedef struct _call_frame_t {
     scope_chain_t *base_scope;
 
     IDispatch *this_obj;
+    jsdisp_t *variable_obj;
 
     bytecode_t *bytecode;
     function_code_t *function;
@@ -211,7 +212,6 @@ struct _exec_ctx_t {
     LONG ref;
 
     script_ctx_t *script;
-    jsdisp_t *var_disp;
     BOOL is_global;
 
     jsval_t ret;
@@ -223,6 +223,6 @@ static inline void exec_addref(exec_ctx_t *ctx)
 }
 
 void exec_release(exec_ctx_t*) DECLSPEC_HIDDEN;
-HRESULT create_exec_ctx(script_ctx_t*,jsdisp_t*,BOOL,exec_ctx_t**) DECLSPEC_HIDDEN;
-HRESULT exec_source(exec_ctx_t*,bytecode_t*,function_code_t*,scope_chain_t*,IDispatch*,jsval_t*) DECLSPEC_HIDDEN;
+HRESULT create_exec_ctx(script_ctx_t*,BOOL,exec_ctx_t**) DECLSPEC_HIDDEN;
+HRESULT exec_source(exec_ctx_t*,bytecode_t*,function_code_t*,scope_chain_t*,IDispatch*,jsdisp_t*,jsval_t*) DECLSPEC_HIDDEN;
 HRESULT create_source_function(script_ctx_t*,bytecode_t*,function_code_t*,scope_chain_t*,jsdisp_t**) DECLSPEC_HIDDEN;
diff --git a/dlls/jscript/function.c b/dlls/jscript/function.c
index 05792bd29d0..8cd363dc5e3 100644
--- a/dlls/jscript/function.c
+++ b/dlls/jscript/function.c
@@ -239,13 +239,13 @@ static HRESULT invoke_source(script_ctx_t *ctx, FunctionInstance *function, IDis
 
     hres = scope_push(function->scope_chain, var_disp, to_disp(var_disp), &scope);
     if(SUCCEEDED(hres)) {
-        hres = create_exec_ctx(ctx, var_disp, FALSE, &exec_ctx);
+        hres = create_exec_ctx(ctx, FALSE, &exec_ctx);
         if(SUCCEEDED(hres)) {
             jsdisp_t *prev_args;
 
             prev_args = function->arguments;
             function->arguments = arg_disp;
-            hres = exec_source(exec_ctx, function->code, function->func_code, scope, this_obj, r);
+            hres = exec_source(exec_ctx, function->code, function->func_code, scope, this_obj, var_disp, r);
             function->arguments = prev_args;
 
             exec_release(exec_ctx);
diff --git a/dlls/jscript/global.c b/dlls/jscript/global.c
index 5574f504f5e..73bee824747 100644
--- a/dlls/jscript/global.c
+++ b/dlls/jscript/global.c
@@ -223,7 +223,8 @@ static HRESULT JSGlobal_eval(script_ctx_t *ctx, vdisp_t *jsthis, WORD flags, uns
         return throw_syntax_error(ctx, hres, NULL);
     }
 
-    hres = exec_source(ctx->call_ctx->exec_ctx, code, &code->global_code, frame->scope, frame->this_obj, r);
+    hres = exec_source(ctx->call_ctx->exec_ctx, code, &code->global_code, frame->scope,
+            frame->this_obj, frame->variable_obj, r);
     release_bytecode(code);
     return hres;
 }
diff --git a/dlls/jscript/jscript.c b/dlls/jscript/jscript.c
index 3dda22c17f1..88c16165e89 100644
--- a/dlls/jscript/jscript.c
+++ b/dlls/jscript/jscript.c
@@ -105,14 +105,14 @@ static HRESULT exec_global_code(JScript *This, bytecode_t *code)
     exec_ctx_t *exec_ctx;
     HRESULT hres;
 
-    hres = create_exec_ctx(This->ctx, This->ctx->global, TRUE, &exec_ctx);
+    hres = create_exec_ctx(This->ctx, TRUE, &exec_ctx);
     if(FAILED(hres))
         return hres;
 
     IActiveScriptSite_OnEnterScript(This->site);
 
     clear_ei(This->ctx);
-    hres = exec_source(exec_ctx, code, &code->global_code, NULL, NULL, NULL);
+    hres = exec_source(exec_ctx, code, &code->global_code, NULL, NULL, This->ctx->global, NULL);
     exec_release(exec_ctx);
 
     IActiveScriptSite_OnLeaveScript(This->site);
@@ -776,14 +776,14 @@ static HRESULT WINAPI JScriptParse_ParseScriptText(IActiveScriptParse *iface,
     if(dwFlags & SCRIPTTEXT_ISEXPRESSION) {
         exec_ctx_t *exec_ctx;
 
-        hres = create_exec_ctx(This->ctx, This->ctx->global, TRUE, &exec_ctx);
+        hres = create_exec_ctx(This->ctx, TRUE, &exec_ctx);
         if(SUCCEEDED(hres)) {
             jsval_t r;
 
             IActiveScriptSite_OnEnterScript(This->site);
 
             clear_ei(This->ctx);
-            hres = exec_source(exec_ctx, code, &code->global_code, NULL, NULL, &r);
+            hres = exec_source(exec_ctx, code, &code->global_code, NULL, NULL, This->ctx->global, &r);
             if(SUCCEEDED(hres)) {
                 if(pvarResult)
                     hres = jsval_to_variant(r, pvarResult);