Invalid access to memory location using GlobalFree

[OReubens]

but the l_State variable is assigned in the window message pump thread, so unless you can prove that such assignments and comparisons are atomic synchronization is needed here.

Correct.
Although there are better ways to achieve the same effect.

If you assume the VC compiler (and some others) then marking the bool as volatile and making sure it's properly aligned would be sufficient.
if you can't assume a particular brand of compiler and a particular way it handles volatile (the spec guarantees nothing) you need explicit synchronisation. Even in that case, there's better ways around it.

But the whole idea here of creating a thread and then communicating with the main thread via timer messages makes it obvious that the guy that wrote this was just clueless on what he was actually trying to do.