When interacting with an HTML input element's file picker dialog with webkitdirectory set a use-after-free could have resulted leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 94 Thunderbird < 91.3 and Firefox ESR < 91.3.