I'm still not sure, but it and the friend class and the reset of ihash to NULL in destructor, suggest in some previous guise, it was accessing iHash in the base.. that doesn't explain the _tmp really.