The mandb tool will generate use-after-free errors in certain situations in the function ult_src().
It can be tested by having a broken man file structure where one file links to another and that links to a nonexistent file. Place attached files a.1 and b.1 into /usr/share/man/man1/ and run
mandb -f /usr/share/man/man1/a.1

Using either valgrind or address sanitizer will show the uaf error. It is happening in this code path (line 376ff):
free(base);
base = find_include (name, path, include);

I'm not exactly sure why this is happening, but it seems in certain situations name and base contain the same memory address. Therefore freeing base will cause name to be an invalid pointer, therefore causing a use-after-free.

I have attached the debugging output from both valgrind and address sanitizer.