Doing this is like including a /usr/lib/libvirtualbox.so.1.2 in multiple Debian packages, getting irritated that other people's packages uninstall your shared library, and then deciding to write a daemon whose goal is to watch for that file being deleted so you can replace it... in essence: a mistake. ;P
AFAIK the way you are supposed to solve this on Windows (if you really aren't in the position to simply think of VirtualBox as a separate project that the user manages using its own Installer) is to use Merge Modules, which track this kind of installation corner case correctly and can be added to multiple MSI files.
Having multiple people compiling, and then sharing, the same components eventually causes you horrible problems one day when you find out that one of the users compiled it with a slightly buggy compiler, and didn't notice because they weren't using that part of the library.
The core benefit, then, of using Merge Modules, is that VirtualBox is able to distribute an official build of the library that people can submit bug reports to ("didn't work on Windows 7 Home SP2"), despite possibly not having its own Installer. Is VirtualBox simply being annoying in not providing official package manager components? :(
Reference: "Each merge module contains unique version information that is used by the Windows Installer database to determine which applications use the component, preventing premature removal of a component. For this reason, a new merge module should be created for every incremental version of your component; a merge module should never be updated after it has been included in an installer."
AFAIK the way you are supposed to solve this on Windows (if you really aren't in the position to simply think of VirtualBox as a separate project that the user manages using its own Installer) is to use Merge Modules, which track this kind of installation corner case correctly and can be added to multiple MSI files.
Having multiple people compiling, and then sharing, the same components eventually causes you horrible problems one day when you find out that one of the users compiled it with a slightly buggy compiler, and didn't notice because they weren't using that part of the library.
The core benefit, then, of using Merge Modules, is that VirtualBox is able to distribute an official build of the library that people can submit bug reports to ("didn't work on Windows 7 Home SP2"), despite possibly not having its own Installer. Is VirtualBox simply being annoying in not providing official package manager components? :(
Reference: "Each merge module contains unique version information that is used by the Windows Installer database to determine which applications use the component, preventing premature removal of a component. For this reason, a new merge module should be created for every incremental version of your component; a merge module should never be updated after it has been included in an installer."
-- http://msdn.microsoft.com/en-us/library/6771e4ch(v=vs.80).as...