Use-after-free when inserting implicit parent selector