Combining race conditions with an integer overflow

Silly javascript interpreter

Classic format string vulnerability