Heap metadata is corrupted. The bad data causes a crash when an attempt is made to validate a particular heap region. However, an indeterminate amount of time has already passed between the original corruption of the data and the eventual crash.
There's a way to make the OS apply greater scrutiny to the heap operations within a given process. That can lead to catching the heap corruptor at the time it does its business, as opposed to later on when its too late and the evidence is obliterated. The procedure:
1) On an elevated (run as admin) CMD prompt, from the directory where you installed the debugging tools:
gflags /p /enable Explorer.exe /full
2) Reboot or restart Explorer (same effect).
3) Once again, run the "cscript adplus.vbs...." command from before.
4) Reproduce the Explorer crash again.
5) Find the new DMP file, hopefully the small one with "2nd_chance" in its name, and upload just that for analysis.