This bug was Use after Free caused by improper handling of javascript object memory references.
Use after Free