Adobe Flash TextField.htmlText Setter - Use-After-Free

Adobe Flash TextField.htmlText Setter - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=578 There is a use-after-free in the TextField.htmlText setter. If the htmlText the field is set to is an object with toString defined, the toString function can free...