There is a use-after-free in the TextField sharpness setter. If the sharpness parameter is an object with valueOf set to a function which frees the TextField parent, it is used after it is freed.
7493a0885f46ddf809858c9ad8b0a46b185be83cdcbfa026ae184f5993e961af