If you start stripping down the code to be short enough to show (but still demonstrably broken), you'll probably stumble across the answer.