shdocvw: Support URLs passed by reference in WebBrowser_Navigate2.
diff --git a/dlls/shdocvw/webbrowser.c b/dlls/shdocvw/webbrowser.c
index 5e97961..e54e9ee 100644
--- a/dlls/shdocvw/webbrowser.c
+++ b/dlls/shdocvw/webbrowser.c
@@ -724,6 +724,7 @@
         VARIANT *TargetFrameName, VARIANT *PostData, VARIANT *Headers)
 {
     WebBrowser *This = WEBBROWSER_THIS(iface);
+    LPCWSTR url;
 
     TRACE("(%p)->(%p %p %p %p %p)\n", This, URL, Flags, TargetFrameName, PostData, Headers);
 
@@ -733,12 +734,20 @@
     if(!URL)
         return S_OK;
 
-    if(V_VT(URL) != VT_BSTR) {
+    switch (V_VT(URL))
+    {
+    case VT_BSTR:
+        url = V_BSTR(URL);
+        break;
+    case VT_BSTR|VT_BYREF:
+        url = *V_BSTRREF(URL);
+        break;
+    default:
         FIXME("Unsupported V_VT(URL) %d\n", V_VT(URL));
         return E_INVALIDARG;
     }
 
-    return navigate_url(&This->doc_host, V_BSTR(URL), Flags, TargetFrameName, PostData, Headers);
+    return navigate_url(&This->doc_host, url, Flags, TargetFrameName, PostData, Headers);
 }
 
 static HRESULT WINAPI WebBrowser_QueryStatusWB(IWebBrowser2 *iface, OLECMDID cmdID, OLECMDF *pcmdf)