diff --git a/dlls/msxml3/httprequest.c b/dlls/msxml3/httprequest.c
index d8ab1b9a801..f9db1cdf7c3 100644
--- a/dlls/msxml3/httprequest.c
+++ b/dlls/msxml3/httprequest.c
@@ -141,9 +141,17 @@ static inline serverhttp *impl_from_IServerXMLHTTPRequest(IServerXMLHTTPRequest
 static void httprequest_setreadystate(httprequest *This, READYSTATE state)
 {
     READYSTATE last = This->state;
+    static const char* readystates[] = {
+        "READYSTATE_UNINITIALIZED",
+        "READYSTATE_LOADING",
+        "READYSTATE_LOADED",
+        "READYSTATE_INTERACTIVE",
+        "READYSTATE_COMPLETE"};
 
     This->state = state;
 
+    TRACE("state %s\n", readystates[state]);
+
     if (This->sink && last != state)
     {
         DISPPARAMS params;
@@ -206,6 +214,7 @@ static void BindStatusCallback_Detach(BindStatusCallback *bsc)
     if (bsc)
     {
         if (bsc->binding) IBinding_Abort(bsc->binding);
+        bsc->request->bsc = NULL;
         bsc->request = NULL;
         IBindStatusCallback_Release(&bsc->IBindStatusCallback_iface);
     }
@@ -340,7 +349,11 @@ static HRESULT WINAPI BindStatusCallback_OnStopBinding(IBindStatusCallback *ifac
     }
 
     if (hr == S_OK)
+    {
+        BindStatusCallback_Detach(This->request->bsc);
+        This->request->bsc = This;
         httprequest_setreadystate(This->request, READYSTATE_COMPLETE);
+    }
 
     return S_OK;
 }
@@ -984,10 +997,9 @@ static HRESULT httprequest_send(httprequest *This, VARIANT body)
     if (This->state != READYSTATE_LOADING) return E_FAIL;
 
     hr = BindStatusCallback_create(This, &bsc, &body);
-    if (FAILED(hr)) return hr;
-
-    BindStatusCallback_Detach(This->bsc);
-    This->bsc = bsc;
+    if (FAILED(hr))
+        /* success path to detach it is OnStopBinding call */
+        BindStatusCallback_Detach(bsc);
 
     return hr;
 }
@@ -995,7 +1007,6 @@ static HRESULT httprequest_send(httprequest *This, VARIANT body)
 static HRESULT httprequest_abort(httprequest *This)
 {
     BindStatusCallback_Detach(This->bsc);
-    This->bsc = NULL;
 
     httprequest_setreadystate(This, READYSTATE_UNINITIALIZED);
 
diff --git a/dlls/msxml3/tests/httpreq.c b/dlls/msxml3/tests/httpreq.c
index e3a1a911a4a..ef760883394 100644
--- a/dlls/msxml3/tests/httpreq.c
+++ b/dlls/msxml3/tests/httpreq.c
@@ -1233,6 +1233,8 @@ typedef struct
     LONG ref;
 } dispevent;
 
+static IXMLHttpRequest *httpreq;
+
 static inline dispevent *impl_from_IDispatch( IDispatch *iface )
 {
     return CONTAINING_RECORD(iface, dispevent, IDispatch_iface);
@@ -1297,6 +1299,9 @@ static HRESULT WINAPI dispevent_Invoke(IDispatch *iface, DISPID member, REFIID r
         LCID lcid, WORD flags, DISPPARAMS *params, VARIANT *result,
         EXCEPINFO *excepInfo, UINT *argErr)
 {
+    LONG state;
+    HRESULT hr;
+
     ok(member == 0, "expected 0 member, got %d\n", member);
     ok(lcid == LOCALE_SYSTEM_DEFAULT, "expected LOCALE_SYSTEM_DEFAULT, got lcid %x\n", lcid);
     ok(flags == DISPATCH_METHOD, "expected DISPATCH_METHOD, got %d\n", flags);
@@ -1311,6 +1316,20 @@ static HRESULT WINAPI dispevent_Invoke(IDispatch *iface, DISPID member, REFIID r
     ok(argErr == NULL, "got %p\n", argErr);
 
     g_expectedcall++;
+
+    state = READYSTATE_UNINITIALIZED;
+    hr = IXMLHttpRequest_get_readyState(httpreq, &state);
+    ok(hr == S_OK, "got 0x%08x\n", hr);
+    if (state == READYSTATE_COMPLETE)
+    {
+        BSTR text = NULL;
+
+        hr = IXMLHttpRequest_get_responseText(httpreq, &text);
+        ok(hr == S_OK, "got 0x%08x\n", hr);
+        ok(*text != 0, "got %s\n", wine_dbgstr_w(text));
+        SysFreeString(text);
+    }
+
     return E_FAIL;
 }
 
@@ -1332,7 +1351,7 @@ static IDispatch* create_dispevent(void)
     event->IDispatch_iface.lpVtbl = &dispeventVtbl;
     event->ref = 1;
 
-    return (IDispatch*)&event->IDispatch_iface;
+    return &event->IDispatch_iface;
 }
 
 static IXMLHttpRequest *create_xhr(void)
@@ -1507,6 +1526,7 @@ static void test_XMLHTTP(void)
     EXPECT_HR(hr, S_OK);
     ok(state == READYSTATE_UNINITIALIZED, "got %d, expected READYSTATE_UNINITIALIZED\n", state);
 
+    httpreq = xhr;
     event = create_dispevent();
 
     EXPECT_REF(event, 1);