If a method is called on a MovieClip in Adobe Flash, and a getter is set with the name of the method, the getter will get executed during the call, and can free the MovieClip, leading to a user-after-free.
5297ca949527a1f37c7a68df5d64c04365012ff2f457cbb7ba111a0c2dac12ee
Gentoo Linux Security Advisory 201607-3 - Multiple vulnerabilities have been found in Adobe Flash Player, the worst of which allows remote attackers to execute arbitrary code. Versions less than 11.2.202.632 are affected.
0ced70ce46c6bc69a8de361251892d7f727488e726c52bdd9e961f23649e5d8c