The problem is with the LPARAM of RB_GETBANDINFOW. The address of the structure you are sending is only valid in your own address space, not that of Explorer. Luckily, Explorer detects this and fails gracefully instead of blowing up.
One way to solve this is to use VirtualAllocEx to allocate the REBARBANDINFOW in Explorer's memory, use WriteProcessMemory to initialize it, send the message, and finally call ReadProcessMemory to read the result.
I've successfully used this technique in a Python script to automatically set the Quick Launch's size.