Your TCMD.GPF unfortunately was meaningless (pointing at code that your DIR would never execute), and missing almost all of the stack trace. (Thus likely to be a stack overwrite, which is almost impossible to debug without access to a system that can reproduce the problem.) I'm also unclear why you refer to this as "multiple path wildcards" (which would certainly be a problem) -- your example only has one path wildcard (and one filename wildcard).
Remember (see the help) that using /S with path wildcards is almost certainly not going to return anything remotely like the results you expect. You're likely to end up with multiple (maybe many, many) simultaneous /S operations, which could easily (at least on a 32-bit system) gobble up all the available memory if you have a sufficiently large directory tree. (Not to mention getting into some really deep levels of recursion inside DIR while trying to process the directories.) In your example, the /S would only be useful if you had multiple subdirectories named "_weigh", and none of them in the current directory.
How big is the directory structure you're trying to display? I.e., any chance it can be zipped up and sent here?
Is this reproducible every time on your system? Does it behave the same way without the /S, date range, and/or attribute switch?