I've run 1500 times (with a timer of 2 seconds) the Online's script, mIRC never crashed on my computer.

When mIRC crashes, it refers to the instruction at 0x0042c757.
I've used a debugger to trace in mIRC's code :
0x0042c757 is executed when the DCC Chat windows are closed, this is a compare instruction : CMP [EBP+528], EBX.
The crash occurs when EBP+528 is actually out of bounds regarding the memory allocated for mIRC.
I've ran the test with the magic number 20 :

Code:
01st window closed : EBP+528 = 0x00E4BA78, data in memory at this address : 00000000 00000000 00000000 01000000
02nd window closed : EBP+528 = 0x00E4D598, data in memory at this address : 00000000 00000000 00000000 01000000
03rd window closed : EBP+528 = 0x00E4F0D8, data in memory at this address : 00000000 00000000 00000000 01000000
04th window closed : EBP+528 = 0x01CF1310, data in memory at this address : 00000000 00000000 00000000 01000000
05th window closed : EBP+528 = 0x01CF2948, data in memory at this address : 00000000 00000000 00000000 01000000
06th window closed : EBP+528 = 0x01CF42E0, data in memory at this address : 00000000 00000000 00000000 01000000
07th window closed : EBP+528 = 0x01CF5E88, data in memory at this address : 00000000 00000000 00000000 01000000
08th window closed : EBP+528 = 0x01CFB228, data in memory at this address : 00000000 00000000 00000000 01000000
09th window closed : EBP+528 = 0x01CF7A40, data in memory at this address : 00000000 00000000 00000000 01000000
10th window closed : EBP+528 = 0x01CF9620, data in memory at this address : 00000000 00000000 00000000 01000000
11th window closed : EBP+528 = 0x01CFCE58, data in memory at this address : 00000000 00000000 00000000 01000000
13th window closed : EBP+528 = 0x01CFEAB0, data in memory at this address : 00000000 00000000 00000000 01000000
14th window closed : EBP+528 = 0x01D00730, data in memory at this address : 00000000 00000000 00000000 01000000
15th window closed : EBP+528 = 0x01C023D8, data in memory at this address : ???????? ???????? ???????? ???????? => not allocated !
=> The instruction at "0x0042c757" referenced memory at "0x01C023D8". The memory could not be "read".
=> Application terminated.


This explains why the magic numbers are different between computers, and we could even say it'll be different for
every instance of mIRC launched, because it depends on how the memory is allocated when mIRC requests it.
So it depends on how many RAM you have, which OS you use, how many applications are launched at the time you run
mIRC, how fragmented is your RAM (in my example we can see a "jump" of memory location), etc...
That's also why it happens for some people when they are not connected only, that's because some more memory is used
when they are connected, and the memory used for DCC chats will not be exactly at the same place...
This is also why it happens to me randomly without using any "crash script" as given in this thread : I run a bot
which is connected 24/24, and a lot of memory is allocated/deallocated by mIRC in this given time... So it can
crash with only 2 DCC's ! (That's also what happened to Online).

I think it can be remotely exploitable if you know that you just have to open/close DCC Chats with somebody that
automatically accepts it, or which is running a chat dccserver !