Since no one react, I tried to reverse engineer Boost.Function and pin down the problem: template <typename R, typename Arg1> struct Functor { template <typename F> Functor(F f, int i = 0) : m_pf(0) { m_pf = reinterpret_cast<Pf>(f); } template <typename T> R Invoke(T t) { typedef R (*Pf1)(Arg1); return (*(Pf1)m_pf)(t); } typedef void (*Pf)(void); Pf m_pf; }; template <typename T> bool func_template(T* p) { return p != 0; } void TestBugFunctor() { Functor<bool, int*> fc2 = &func_template<int>; fc2.Invoke((int*)0); //crash } The trick with the extra dummy constructor argument is copied form boost function header files. Without it one gets an ICE, but with it, VStudio 2003 sp1 generates a suspectable call. I will crosspost this in a M$ group and find out if there are interesting reactions.