Use-after-free in Webkit EventTarget.
Click to trigger the bug