There is a use-after-free in Adobe Flash Selection.setFocus. It is a static method, but if it is called with a this object, it will be called on that object's thread. Then, if it calls into script, for example, by calling toString on the string parameter, the object, and its thread will be deleted, and a use-after-free occurs.
fa507c4afbb1bc497d0cc5c2a99904cd2a73bd86ee4b1d906ad6cf627872c99b
Gentoo Linux Security Advisory 201607-3 - Multiple vulnerabilities have been found in Adobe Flash Player, the worst of which allows remote attackers to execute arbitrary code. Versions less than 11.2.202.632 are affected.
0ced70ce46c6bc69a8de361251892d7f727488e726c52bdd9e961f23649e5d8c