My suspicions were correct: it is a threading bug, and it turns out that the steps are even simpler:
- Start the Database Engine Tuning Advisor
- Drop down the “Server name” listbox and choose “Browse for more…”
- Click the Network Servers tab
- Click the Cancel button
- Wait a few seconds … until the application crashes…
The background discovery thread tries to access the TreeView control in the browse dialog, which no longer exists since you closed it. Oops. I’m not sure how this one got past QA. I passed the info on to friends in the SQL Server group, and probably ruined their days.