VC++ 2005 replace _bstr_t

Hi-
  I've got a C++ app BHO i'm working on. I'm having trouble escaping
values in a _bstr_t for xml. Here's my code.

void Replace(_bstr_t& strSource, _bstr_t& strFind, _bstr_t& strRep)
{
    wstring tmp((wchar_t*)strSource);
    wstring::size_type begidx = tmp.find((wchar_t*)strFind);

    while(begidx != wstring::npos) {
        tmp.replace(begidx, strFind.length(), (wchar_t*)strRep);
        begidx = tmp.find_first_of((wchar_t*)strFind, begidx +
strFind.length(), begidx);
    }

    strSource = tmp.c_str();

}

void escapeXML(_bstr_t& strSource)
{
    _bstr_t strFind("<");
    _bstr_t strRep("&lt;");

    Replace(strSource, strFind, strRep);

    _bstr_t strFind2(">");
    _bstr_t strRep2("&gt;");

    Replace(strSource, strFind2, strRep2);

    _bstr_t strFind3("&");
    _bstr_t strRep3("&amp;");

    Replace(strSource, strFind3, strRep3);

    _bstr_t strFind4("'");
    _bstr_t strRep4("&apos;");

    Replace(strSource, strFind4, strRep4);

    _bstr_t strFind5("\"");
    _bstr_t strRep5("&quot;");

    Replace(strSource, strFind5, strRep5);
}

/* and here is my code where i run this funciton

BSTR pURL;
pHtmlDoc2->get_URL(&pURL);
_bstr_t sURL(pURL, false);

escapeXML(sURL);

When I run it then it takes out IE (processor runs at 100%). I figure
it's probably a memory allocation thing or something. Anyone have any
ides? I know I could do this using MFC and converting it to a
CString, but I'd rather keep to the standard library if possible.

Thanks