Well the use after free on the stack was getting the aame memory over and over so it just happened to work in the case above. Until it didn't.