diff --git a/Source/exehead/Main.c b/Source/exehead/Main.c
index 5002272c..5c91796e 100644
--- a/Source/exehead/Main.c
+++ b/Source/exehead/Main.c
@@ -52,6 +52,8 @@ char *ValidateTempDir()
   return my_GetTempFileName(state_language, state_temp_dir);
 }
 
+void *g_SHGetFolderPath;
+
 int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInst,LPSTR lpszCmdParam, int nCmdShow)
 {
   int ret = 0;
@@ -74,6 +76,19 @@ int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInst,LPSTR lpszCmdParam,
   }
 #endif
 
+  // load shfolder.dll before any script code is executed to avoid
+  // weird situations where SetOutPath or even the extraction of 
+  // shfolder.dll will cause unexpected behavior.
+  //
+  // this also prevents the following:
+  //
+  //  SetOutPath "C:\Program Files\NSIS" # maybe read from reg
+  //  File shfolder.dll
+  //  Delete $PROGRAMFILES\shfolder.dll # can't be deleted, as the
+  //                                    # new shfolder.dll is used
+  //                                    # to find its own path.
+  g_SHGetFolderPath = myGetProcAddress(MGA_SHGetFolderPathA);
+
   {
     // workaround for bug #1008632
     // http://sourceforge.net/tracker/index.php?func=detail&aid=1008632&group_id=22049&atid=373085
diff --git a/Source/exehead/util.c b/Source/exehead/util.c
index ef7d34f7..153c621a 100644
--- a/Source/exehead/util.c
+++ b/Source/exehead/util.c
@@ -597,6 +597,7 @@ const char SYSREGKEY[]   = "Software\\Microsoft\\Windows\\CurrentVersion";
 const char QUICKLAUNCH[] = "\\Microsoft\\Internet Explorer\\Quick Launch";
 
 typedef HRESULT (__stdcall * PFNSHGETFOLDERPATHA)(HWND, int, HANDLE, DWORD, LPSTR);
+extern void *g_SHGetFolderPath;
 
 // Based on Dave Laundon's simplified process_string
 char * NSISCALL GetNSISString(char *outbuf, int strtab)
@@ -628,9 +629,6 @@ char * NSISCALL GetNSISString(char *outbuf, int strtab)
 
         int x = 2;
 
-        // Use SHGetFolderPath when shfolder.dll is available
-        PFNSHGETFOLDERPATHA pSHGetFolderPath = (PFNSHGETFOLDERPATHA) myGetProcAddress(MGA_SHGetFolderPathA);
-
         if (g_exec_flags.all_user_var)
         {
           x = 4;
@@ -656,8 +654,13 @@ char * NSISCALL GetNSISString(char *outbuf, int strtab)
 
         while (x--)
         {
-          if (pSHGetFolderPath) {
-            if (!pSHGetFolderPath(g_hwnd, fldrs[x], NULL, SHGFP_TYPE_CURRENT, out)) break;
+          if (g_SHGetFolderPath)
+          {
+            PFNSHGETFOLDERPATHA SHGetFolderPathFunc = (PFNSHGETFOLDERPATHA) g_SHGetFolderPath;
+            if (!SHGetFolderPathFunc(g_hwnd, fldrs[x], NULL, SHGFP_TYPE_CURRENT, out))
+            {
+              break;
+            }
           }
             
           if (!SHGetSpecialFolderLocation(g_hwnd, fldrs[x], &idl))