There is a use-after-free in Selection.SetSelection. If it is called with a number parameter, which is an object with valueOf defined, and this function frees the parent of the TextField parameter, the object is used after it is freed. A minimal PoC follows:
217561bd45b3c92552115daee855b258b298674d8c5a5b4f03c0a9d14d073306