If IExternalizable.readExternal is overridden with a value that is not a function, Flash assumes it is a function even though it is not one. This leads to execution of a 'method' outside of the ActionScript object's ActionScript vtable, leading to memory corruption.
737efddab602eec39d06bc429fedf7225e7faf8def073ec48a4f8043b9874e33