No writeups match your filter.
Use-after-free on a tcache chunk to overwrite a function pointer and call win().