There is a use-after-free in MovieClip.startDrag. If a parameter an object with valueOf defined, this method can free the MovieClip, which is then used.
e479fa941ff211a21353dd962d4b4fe88a594a11c11379dd4a855f8d02e16580
© 2022 Packet Storm. All rights reserved.