A pointer to a local VPS is passed as reference into the parameter set manager, which takes ownership of the object.
When the local scope is left, the memory will be freed, which can lead to use after free (and double free).