Thanks for your help, it should be Boss leak, I have modified everywhere.
At first I observered IID_IIDXMLELEMENT(kXMLCreateElementCmdBoss) or IID_IHIERARCHY_DOCUMENT(kNewPageItemCmdBoss) instead of IID_ICOMMANDMGR.
But after several crash, I began to look for other ways, it is obvious that I made a mistake.