CreateRemoteThreadEx fails on call-chain?

HANDLE hThread = CreateRemoteThreadEx(processHandler,
		NULL,
		0,
		(LPTHREAD_START_ROUTINE)remoteFooThreadFunc,
		(LPVOID)remoteParam,
		0,
		NULL,
		&dwThreadId);

Quote:

// Unhandled exception at 0x________ in why.exe: 0x________: Access violation executing location 0x________.

// This example program fails at: '((barFunc_T)(param->func))(¶m->data);',
// the section tagged with '@WHY'
// The program was made using 'Microsoft Visual Studio Express 2013 for Windows Desktop'.
// It can be inserted into any default console application with one modification under:
// Property Pages -> Configuration Properties -> C/C++ -> All Options
// 'Enable Function-Level Linking'
// has to be set to:
// 'No (/Gy-)'

#include "stdafx.h"
#include <iostream>
#include <windows.h>
#include <string>

DWORD_PTR inject(HANDLE hProcess, DWORD_PTR data, size_t dataSize)
{
	DWORD_PTR remoteMemoryAddress = NULL;
	SIZE_T bytesTesferred = 0; // number of bytes written/read to/from the remote process;
	remoteMemoryAddress = (DWORD_PTR)VirtualAllocEx(hProcess,
		0,
		dataSize,
		MEM_COMMIT,
		PAGE_EXECUTE_READWRITE);
	if (remoteMemoryAddress == NULL) {
		return NULL;
	}
	bool succeed = WriteProcessMemory(hProcess,
		(LPVOID)remoteMemoryAddress,
		(LPCVOID)data,
		dataSize,
		&bytesTesferred);

	if (!succeed){
		return NULL;
	}
	return remoteMemoryAddress;
}

typedef struct FooParam_t {
	size_t data;
	FooParam_t* next;
	DWORD_PTR func;
} FooParam;

static DWORD* barFunc(size_t* pData) {
	*pData = 9;
	return NULL;
}
static void afterBarFunc(void){}

typedef DWORD* (*barFunc_T)(size_t* pData);
static DWORD* fooThreadFunc(FooParam* param) {

	while (param != NULL){
		// this works as a charm
		param->data = 42;

		// but the next line causes crash if uncommented
		//((barFunc_T)(param->func))(¶m->data); // @WHY

		// Unhandled exception at 0x________ in why.exe:
		// 0x________: Access violation executing location 0x________.
		param = param->next;
	}
	return NULL;
}
static void afterFooThreadFunc(void){}


bool test() {
	HANDLE processHandler = GetCurrentProcess(); //for the sake of simplicity
	DWORD_PTR remoteBarFunc = inject(processHandler,
		(DWORD_PTR)barFunc,
		(size_t)(((LPBYTE)afterBarFunc) - ((LPBYTE)barFunc)));

	FooParam param2;
	param2.data = 0;
	param2.next = NULL;
	param2.func = remoteBarFunc;
	FooParam param1;
	param1.data = 0;
	param1.next = (FooParam*)inject(processHandler,
		(DWORD_PTR)¶m2,
		sizeof(FooParam));

	param1.func = remoteBarFunc;
	DWORD_PTR remoteParam = inject(processHandler,
		(DWORD_PTR)¶m1,
		sizeof(FooParam));

	DWORD_PTR remoteFooThreadFunc = inject(processHandler,
		(DWORD_PTR)fooThreadFunc,
		(size_t)(((LPBYTE)afterFooThreadFunc) - ((LPBYTE)fooThreadFunc)));

	DWORD dwThreadId = 0;
	HANDLE hThread = CreateRemoteThreadEx(processHandler,
		NULL,
		0,
		(LPTHREAD_START_ROUTINE)remoteFooThreadFunc,
		(LPVOID)remoteParam,
		0,
		NULL,
		&dwThreadId);

	if (hThread == NULL) {
		return false;
	}

	// remoteBarFunc can even be directly called, since:
	// processHandler = GetCurrentProcess();
	size_t test = 0;
	((barFunc_T)(remoteBarFunc))(&test);
	if (test != 9) {
		return false;
	}

	WaitForSingleObject(hThread, INFINITE);
	FooParam buffer1;
	buffer1.data = 0;
	buffer1.next = NULL;
	ReadProcessMemory(processHandler,
		(LPVOID)(remoteParam),
		&buffer1,
		sizeof(FooParam),
		NULL);

	FooParam buffer2;
	buffer2.data = 0;
	buffer2.next = NULL;
	ReadProcessMemory(processHandler,
		(LPVOID)(buffer1.next),
		&buffer2,
		sizeof(FooParam),
		NULL);

	return (buffer1.data == 42 && buffer2.data == 42);
}

#include "stdafx.h"


int _tmain(int argc, _TCHAR* argv[])
{

	std::string in;
	std::cout << "TestCase "
		<< (test() ? "succeeded" : "   failed")
		<< " : (injecting thread function that calls injected function)"
		<< std::endl;

	std::cin >> in;
	return 0;
}

static DWORD* barFunc(size_t* pData) {
    *pData = 9;
    std::cout << "987654321" << std::endl;
    return NULL;
}

static DWORD* fooThreadFunc(FooParam* param) {

    while (param != NULL){
        ((barFunc_T)(param->func))(&param->data); // @WHY
        std::cout << "123456789" << std::endl;
        param = param->next;
    }
    return NULL;
}
static void afterFooThreadFunc(void){}