ImageMagick has Use After Free in MSLStartElement in "coders/msl.c"

A crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing...