Why does ON_CALL generates an exception when EXPECT_CALL doesn't?

Question

I have a piece of legacy code I'm trying to test using mocks. I want to use ON_CALL or DefaultValue instead of EXPECT_CALL as is recommended in the CheatSheet and CookBook. However, both of those two throw an exception, while EXPECT_CALL doesn't. Here is more or less what the code looks like:

class A
{
public:
    virtual B* GetB() { return m_b; }
private:
    B* m_b;
};

class B
{
public:
    virtual C* GetC() { return m_c; }
private:
    C* m_c;
};

class C
{
public:
    virtual void doSomething()
    {
        std::cout << "I just did something.\n";
    }
};

class D
{
public:
    Foo(A* a)
    {
        C* c = a->GetB()->GetC(); // statement causing exception under test
        c->doSomething();
    }
};

So I mocked A, B and C, and in the test harness I have something like:

#include <gtest/gtest.h>
#include <gmock/gmock.h>

using ::testing::Return;

class MockA : public A
{
public:
    MOCK_METHOD0(GetB, MockB*());
};

class MockB : public B
{
public:
    MOCK_METHOD0(GetC, MockC*());
};

class MockC : public C
{
public:
    MOCK_METHOD0(doSomething, void());
};

class TestD : public ::testing::Test
{
public:
    TestD()
    {
        EXPECT_CALL(aMock, GetB()).WillRepeatedly(Return(&bMock));
        EXPECT_CALL(bMock, GetC()).WillRepeatedly(Return(&cMock));

        // Throws exception in doSomething()
        //ON_CALL(aMock, GetB()).WillByDefault(Return(&bMock));
        //ON_CALL(bMock, GetC()).WillByDefault(Return(&cMock));

        // Throws exception in doSomething()
        //::testing::DefaultValue<B*>::Set(&bMock);
        //::testing::DefaultValue<C*>::Set(&cMock);
    }

    NiceMock<MockA> aMock;
    NiceMock<MockB> bMock;
    MockC cMock;
};

TEST_F(TestD, FooDoSomething)
{
    D d;
    EXPECT_CALL(cMock, doSomething()).Times(1);
    d.Foo(&aMock);
}

Now I tried debugging but it gets sketchy when entering mocked methods. One thing I have noticed is the functions all return non-null pointers, which I suppose is good. I just don't understand why an exception is thrown, but more importantly, why is the EXPECT_CALL behaviour different than ON_CALL or DefaultValue. From what I could gather around the intertubes, there should be no difference other than EXPECT will silence the "uninteresting call" warnings.

The exception thrown is an SEH:

1>[----------] 1 test from TestD
1>[ RUN      ] TestD.FooDoSomething
1>Stack trace:
1>unknown file: error: SEH exception with code 0xc0000005 thrown in the test body.
1>[  FAILED  ] TestD.FooDoSomething (1 ms)
1>[----------] 1 test from TestD (1 ms total)