Can you give an example exploit that goes from a data bug to full control given dynamic dispatch? Less runtime / static guarantees may mean you pass the wrong

Can you give an example exploit that goes from a data bug to full control given dynamic dispatch? Less runtime / static guarantees may mean you pass the wrong class type to a method, but typically all that happens is that that object cannot perform the right selector. I can sort of see this being slightly chained to get some mild exploit, but I’d imagine this is pretty edge condition / rare as it would need to respond to the expected selector in the right way useful for exploit. I’ve written a ton of obj-c and work in it, and almost never need or see the use of C.