Ashely
tecbug had reported a bug --capx
I trace the code and found that (line 1339)
"type.instances.length" might have some problem after destroyed(remove reference from array I thought).
In this capx, the item count of "type.instance" become 2 (saw at firebug), but "type.instances.length" still to be 3.
So that
inst = type.instances[2]; (line 1341)
inst will be null.
I'm not sure the root cause, just report what I found.