When threaded locales are not enabled but an app is using setlocale() concurrently, create_locinfo() may use old locale after free. That happens because the reference is held from thread data, but some functions called from within create_locinfo() can get_locinfo() (->update_thread_locale) and that may result in freeing the old locinfo.