tl;dr

• Race condition to change the type.
• Leak using uninitialized memory and get rip with overflow.