Artifex MuJS up to and including 1.0.7 has a use-after-free in jsrun.c because of unconditional marking in jsgc.c.
artifex mujs