macOS IOBluetooth RFCOMM delegate UAF (browser process)

Click the button and select the colluding Bluetooth Classic SPP device in the chooser. The colluding device must accept the baseband ACL link and then reject/abort the RFCOMM channel (or drop the link) so that IOBluetooth delivers -rfcommChannelClosed: while the delegate's _strongSelf is still nil.