There is a use-after-free in MovieClip.attachMovie. If a string parameter has toString defined, a number parameter has valueOf defined or an object parameter has its constructor redefined, it can execute code and free the this object of the method, leading to a use-after-free.
ed4db34e43e3caa36fcc1564a0d73c60bdb53d44cd0b9886a1954a6e86a5fde3