There is a use-after-free in MovieClip.attachBitmap. If the depth parameter is an object with valueOf defined, this method can free the MovieClip, which is then used.
>> AUTHOR: deepcore
Ovidentia maillist Module 4.0 – Remote File Inclusion Exploit
Microsoft Windows win32k Local Privilege Escalation (MS15-010)
Joomla 1.5 – 3.4.5 – Object Injection RCE X-Forwarded-For Header
PFSense <= 2.2.5 – Directory Traversal
Adobe Flash TextField.variable Setter – Use-After-Free
Adobe Flash MovieClip.localToGlobal – Use-After-Free
Adobe Flash MovieClip.attachMovie – Use-After-Free
Adobe Flash TextField.replaceText – Use-After-Free
Adobe Flash TextField.tabIndex Setter – Use-After-Free