Adobe Flash TextField.tabIndex Setter - Use-After-Free

Adobe Flash TextField.tabIndex Setter - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=574 There is a use-after-free in the TextField.tabIndex setter. If the integer parameter is an object with valueOf defined, then it can free the TextField's parent,...