The legacy MozJS engine doesn't call advanceGeneration() before entering the $accumulator function, which means global objects from a previous invocation which have already been freed can be reread. An attacker could exploit this bug to access all kinds of internal process data that they shouldn't have access to.