There is a use-after-free in Adobe Flash BitmapData.copyPixels. If the method is called on a MovieClip, and the MovieClip is deleted during parameter conversions, it is used to convert future parameters, even though it has already been freed.
0a3401d2588c89c8cb83520304f111cda886ab6b1fa44838fdd32599be2f4efa