If a method is called on a MovieClip in Adobe Flash, and a getter is set with the name of the method, the getter will get executed during the call, and can free the MovieClip, leading to a user-after-free.
5297ca949527a1f37c7a68df5d64c04365012ff2f457cbb7ba111a0c2dac12ee