The problem is that the second parameter of the CreateProcess function is an in/out parameter.
If you specify it as a string like you did, it is a constant string and the function when it is called cannot write to the memory location, thus you have a memory access violation. The correct way is to call your function like this:
LPTSTR szCmdline = _tcsdup(TEXT("C:\\Windows\\Notepad.exe"));
//create child process
if (!CreateProcess(NULL,
    szCmdline,
    NULL,
    NULL,
    FALSE,
    0,
    NULL,
    NULL,
    &si,
    &pi))
{
    fprintf(stderr, "create process failed");
    return -1;
}
You may also want to read this blog article.