There is a use-after-free in the Adobe Flash MovieClip Transform getter. If the Transform constructor is replaced with a getter using addProperty, this getter can free the MovieClip before it is accessed.
8e0a48ee796dc46bf201b5bec60fb0c2fea4eaaff0ede8662854456151504e5c