There is a use-after-free in the TextField.replaceText function. If the function is called with a string parameter with toString defined, or an integer parameter with valueOf defined, the parent object of the TextField can be used after it is freed.
e63876f27dc914022bc2a7ed2d30bcba34c54e4c16104e2d22aad1102cd2ffe5