Code execution via panic-unsafe element deallocation

Memory corruption in Mozilla thin-vec before 0.2.16 allows local users to trigger double frees and use-after-free during element drop. IntoIter::drop and ThinVec::clear call ptr::drop_in_place before zeroing the container length, so a panicking element destructor leaves freed entries marked live and drops them again during unwinding. Exploitation requires heap-owning elements, a destructor panic, and either a partially consumed iterator or clear(); with boxed trait objects, reclaiming the freed slot with an attacker-controlled vtable redirects later drop calls to code execution.