VERSION
Chrome Version: 57.0.2987.21 beta (64-bit), pepflashplayer 24.0.0.221
Operating System: Windows 7 en 64-bit

REPRODUCTION CASE

Open the poc in the attachment with chrome and observe the crash.
There is also a detailed write-up about the vulnerability in the attachment.


FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: tab
Crash State: 

(155c.45c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
pepflashplayer!PPP_ShutdownBroker+0x98cc36:
000007fe`def51436 4c8b01          mov     r8,qword ptr [rcx] ds:00000000`7ffffff0=????????????????
5:109> k
Child-SP          RetAddr           Call Site
00000000`001dd710 000007fe`de79766c pepflashplayer!PPP_ShutdownBroker+0x98cc36
00000000`001dd740 000007fe`de7d4e6f pepflashplayer!PPP_ShutdownBroker+0x1d2e6c
00000000`001dd7f0 000007fe`de7d6094 pepflashplayer!PPP_ShutdownBroker+0x21066f
00000000`001dd9f0 000007fe`de877012 pepflashplayer!PPP_ShutdownBroker+0x211894
00000000`001dda50 000007fe`de86ec68 pepflashplayer!PPP_ShutdownBroker+0x2b2812
00000000`001ddac0 000007fe`de7d5103 pepflashplayer!PPP_ShutdownBroker+0x2aa468
00000000`001ddb30 000007fe`de9b2a15 pepflashplayer!PPP_ShutdownBroker+0x210903
00000000`001ddd30 000007fe`de7ada8a pepflashplayer!PPP_ShutdownBroker+0x3ee215
00000000`001de4e0 000007fe`de7aeade pepflashplayer!PPP_ShutdownBroker+0x1e928a
00000000`001de540 000007fe`de7f7339 pepflashplayer!PPP_ShutdownBroker+0x1ea2de
00000000`001de800 000007fe`de7f72e6 pepflashplayer!PPP_ShutdownBroker+0x232b39
00000000`001de830 000007fe`de7bd111 pepflashplayer!PPP_ShutdownBroker+0x232ae6
00000000`001de880 000007fe`de5db75d pepflashplayer!PPP_ShutdownBroker+0x1f8911
00000000`001de910 000007fe`de60127b pepflashplayer!PPP_ShutdownBroker+0x16f5d
00000000`001deb20 000007fe`de60118e pepflashplayer!PPP_ShutdownBroker+0x3ca7b
00000000`001deb70 000007fe`de60163c pepflashplayer!PPP_ShutdownBroker+0x3c98e
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.21\chrome_child.dll - 
00000000`001deba0 000007fe`e1c32574 pepflashplayer!PPP_ShutdownBroker+0x3ce3c
00000000`001debd0 000007fe`e1c780d5 chrome_child!IsSandboxedProcess+0x216f4
00000000`001dec00 000007fe`e1c4cf8a chrome_child!IsSandboxedProcess+0x67255
00000000`001dec70 000007fe`e1c4cabc chrome_child!IsSandboxedProcess+0x3c10a



Credit:

Yuki Chen Of Qihoo 360 Vulcan Team