The attached SWF file generates a NULL deref on IE, Chrome, standalone projector, etc.

The interesting part is behind this NULL deref hides a use after free that gets exposed on debug builds. 
Chris did some research and here are his comments:

"I should add a note why I think it's a use-after-free: I have access to a debug build and in the debug build, there's a fault at 0xcdcdcdcdcdcdcdcd which I believe is a debugging aid designed to illustrate use-after-free more clearly. It looks like a display object has a stale reference for its parent."

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

 

fuzz-fermin_swfbf-32401.27731-8feb34f77321d753.swf 2.5 MB Download