I haven't seen this behaviour to be honest. We did update the RDSH server while an appstack was attached. Normally the filter driver only merges the appstack (which is read only) onto the operating system.
Could it be that you have also got a writable volume attached to it?
And stopping the filter driver is quite easy, could be worth a shot, i would at least test it.
net stop svdriver
net stop svservice
