Comment by cowlevel

One technique is to just spam the heap full of a certain object you're hoping will overlap it. E.g. if you want to affect a connection object, you might try to open one million simultaneous connections, then touch the UAF object, then check each connection to see if it got messed up. This is called heap spraying and it's often seen in JavaScript vulnerabilities, a bit less in network vulnerabilities since it's easier to allocate a million Uint8Arrays than to open a million TCP connections.