The TextField setFormat method contains a use-after-free. If an integer parameter has valueOf defined, or the object parameter overrides a constructor, this method can free the TextField parent, which is subsequently used.
4fa2435bebe5f4be1d84b27026f8d38e6eabd6157f6c7f69688afb3aa6b813d3