There is a use-after-free in MovieClip.duplicateMovieClip. If the depth or movie name parameter provided is an object with toString or valueOf defined, this method can free the MovieClip, which is then used.
e936ec48ce119179fb911647dd9431f43776db694735d18ab919a4433fa1ad4c