Chain: race condition (CWE-362) from improper handling of a page transition in web client while an applet is loading (CWE-368) leads to use after free (CWE-416)
CVE-2009-0749
realloc generates new buffer and pointer, but previous pointer is still retained, leading to use after free
CVE-2010-3328