A SWF to reproduce is attached, along with source. There's a dependent data file, an mp3, which you should place in the same web server directory as the SWF.
A screenshot of the fault in action is also attached for convenience. Refresh the repro to see different values leak.
NOTE! This is an ActionScript 2 source file, so you'll need to compile accordingly.
The code simply reads the "track" property of the ID3 data in an mp3 file. The property seems to be an ActionScript string based on uninitialized memory.
I'm not 100% sure what's going on; I found this by accident. As far as I know, the mp3 and the ID3 data within it are valid. The only interesting thing is that the "track" string inside the ID3 data is a zero-length string.
