If SafeArrayGetElement is called on a variant array, initialize
destination variant before copying the array element to it, some badly
behaved apps don't seem to do it themselves.

dlls/oleaut32/safearray.c

diff --git a/dlls/oleaut32/safearray.c b/dlls/oleaut32/safearray.c
index 58227ef..3233851 100644
--- a/dlls/oleaut32/safearray.c
+++ b/dlls/oleaut32/safearray.c
@@ -356,7 +356,9 @@
         *((BSTR*)pv) = pbstrReturnedStr; 
     }
     else if( psa->fFeatures == FADF_VARIANT) {
-      HRESULT hr = VariantCopy(pv, elementStorageAddress);
+      HRESULT hr;
+      VariantInit(pv);
+      hr = VariantCopy(pv, elementStorageAddress);
       if (FAILED(hr)) {
         SafeArrayUnlock(psa);
         return hr;