Holding the BindStatusCallback ref is not enough; Abort can end up calling
OnStopBinding which intentionally removes the binding and releases its
ref. urlmon's Abort will then have a use-after-free when accessing the
state to set BINDING_ABORTED, if it was destroyed.
Signed-off-by: Gabriel Ivăncescu <gabrielopcode@gmail.com>