There is a use-after-free issue in MovieClip.localToGlobal. If the Number constructor is overwritten with a new constructor and MovieClip.localToGlobal is called with an integer parameter, the new constructor will get called. If this constructor frees the MovieClip, a use-after-free occurs.
9b00793145cb36766ffc56f7c69bb6851a3d155c2634381ff7926eb04aa8d23d