Memory corruption in Javascript garbage collection.
vulners.com/securityvulns/securityvulns:doc:19690