EIP-2026-103713

This PoC exploits a use-after-free vulnerability in JavaScriptCore's `arrayProtoFuncSplice` function, where uninitialized values in the result array can lead to memory corruption if a garbage collection is triggered before initialization. The exploit uses a getter to force GC during array manipulation.