The XML and XMLNode classes are missing type checks in their constructors. If a class extends a class that sets the object user data, and its constructor contains the following code, type confusion can occur on garbage collection.

		super();
		this.__proto__={};
		this.__proto__.__constructor__ = XML; //Or XMLNode
		super("test");


This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
 

super1.swf 1.4 KB Download

myclass.as 392 bytes Download

mysubclass.as 502 bytes Download

super.fla 6.8 KB Download

super.swf 1.2 KB Download