There are obvious Heap Overflow and Information Leak vulnerabilities.  We can overwrite 24bytes next chunk's data which can modify OS X's magazine_malloc's metadatas (Previous, next pointer).  But, we need to do 4bit brute force as there is cookie check routine.  
In libsystem_c.dylib, there is also lazy binding mechanism like ELF's GOT section.  We can overwrite that area to hijack control flow :)  