Can anyone find the mailing list thread on this topic (or does it not exist because @security are private mailing list)?

I did find another use-after-free bug from a couple months ago on the mailing list:

https://marc.info/?t=177581065500002&r=1&w=2