Why does IDiaEnumSymbolsByAddr::Next crash?

Question

I wanted to enumerate symbols by address but it seems IDiaEnumSymbolsByAddr::Next crash when I call it.

The documentation doesn't say anything extra about it. Minimal code to reproduce:

int main()
{
    IDiaDataSource *ds;
    IDiaSession *session;
    IDiaEnumSymbolsByAddr *symbolEnum;
    IDiaSymbol *symbol;
    HRESULT hr;
    ULONG fetched;

    CoInitialize(NULL);

    hr = makeDiaDataSource(&ds);
    assert(SUCCEEDED(hr));

    hr = ds->loadDataForExe(L"readpdb.exe", NULL, NULL);
    assert(SUCCEEDED(hr));

    hr = ds->openSession(&session);
    assert(SUCCEEDED(hr));

    hr = session->getSymbolsByAddr(&symbolEnum);
    assert(SUCCEEDED(hr));

    hr = symbolEnum->Next(1, &symbol, &fetched); // crash at this line.
    assert(SUCCEEDED(hr));

    printf("All is OK.\n");

    return 0;
}

Is this a bug in the DIA SDK? Or maybe I'm not supposed to use the interface this way?