It has a form of the check For TypeAlias method, which is invoked for each successfully resolved MemberName object and it was leading to the out-of-band vulnerability.

POC : http://www.security-explorations.com...12-01-69.2.zip
Details about exploit : http://www.security-explorations.com...-ORACLE-14.pdf