Double-free crash in USEMAP