There is a use-after-free in the TextField.tabIndex setter. If the integer parameter is an object with valueOf defined, then it can free the TextField's parent, leading to a use-after-free.
0350c0810358682cfb87c4db17446a25f6c8da78348a1edaa5d141e49ebfde1a