Taking advantage of an extra that wasn't charged to the customer?

Ah, that's a classic "use after free" vulnerability.