I've not checked hard, but according to the immunity analysis it has sense:

```
We need to create a user object of bType=FREE (0x0) and bFlags= HANDLEF_DESTROY (0x1). 
This is not possible directly, so we first focus on getting an object with the bFlag value equal to 0x1. For this purpose we create a Menu object, set it to a window, and then Destroy it. The internal reference count for the object did not reach zero because it is still being accessed by the window object, so it is not actually deleted but instead flagged as HANDLEF_DESTROY on the HandleEntry. This means the bFlag will equal to 0x1.

```