There is a use-after-free in MovieClip.attachBitmap. If the depth parameter is an object with valueOf defined, this method can free the MovieClip, which is then used.
1a53857646bf613431067a57c39e68fce010b87e4dc0cc01d200ff2bfadd9beb
© 2022 Packet Storm. All rights reserved.