Flash Player crash introduced in 27.0.0.159 persists in 27.0.0.183, but is fixed in beta builds

As you've observed, when we rush changes out the door, our ability to test is limited, and we can't simulate every possible scenario.  We try really hard, but the math on the possible things you can do in the language across all platforms and under every conceivable network scenario put "test absolutely every possible condition" on a timescale closer to before the heat death of the universe than before next patch tuesday.  Like every QA organization, we employ a variety of strategies, quality control measures and tools to increase our chances of finding every problem before it ships, but bugs are a hard reality.

When dealing with a security issue being exploited in the wild, our approach is to shut the exploit down and get people protected.  While we try not to break things under those circumstances, securing the attack surface is the priority.  Functional issues are a secondary consideration under those circumstances.  It's not reasonable to wait for weeks to fix security issues in the wild, but that necessarily means that we're going to use an abbreviated testing approach, and there's no opportunity for public betas.

It's also worth pointing out that in the instance of the particular issue you're experiencing, only a small subset of the population is affected, the issue was discoverable in public betas before it shipped, and it wasn't introduced by the single, surgical security change that we made and later amended.

When talking about out of band changes, they're necessarily surgical.  Isolating out of cycle builds to a single, surgical change clears an optimized path for testing and release by both our industry partners, like Google and Microsoft, and for the community of Enterprise administrators, many of which would otherwise be required to perform certification testing prior to releasing the build to their administrated populations.  If we were to try to include ancillary stuff, our partners would push back, enterprise administrators are blocked from releasing, and we increase the chance that there are unforseen side-effects.  This guides our approach.  Similarly, when we amended the security fix in 27.0.0.170 to address the issue with enterprises struggling with large vCenter deployments in 27.0.0.183, it was a single, surgical change, overlaid on the original 27.0.0.159 build.

We do not, as policy, ship out of cycle releases for functional issues.  All changes have a risk of side-effects, and functional issues don't meet the bar for waiving all of the testing at Adobe and various partner organizations, or the evaluation conducted by the millions of active beta users.  Flash Player 27.0.0.183 was a rare exception, and it required an extensive amount of research and justification to even be considered.

We conduct extensive certification tests (we have about 30k tests (discounting unit and programmatically generated tests), that we run on multiple machines across dozens of browser/os/language combinations, using a small army of people,  We do that on every regularly scheduled release.  Despite all of that, when you're talking about ~2.5 billion installs, there are going to be edge cases that we can't catch.  To shore that up, we make beta builds available so that developers and administrators can identify issues and ask for corrections before we ship.  In that vein, each out of cycle releases also requires testing.  Testing consumes finite resources.  The out of cycle testing eats into the capacity that we have to do the regular certification testing, which feeds a vicious cycle.  There's also a finite number of patches that administrators and end-users are willing to take.

At the end of the day, we have to walk a fine line of choosing the least bad of manifold bad options, balancing the needs of a massive user population with practical engineering and logistical realities.  This isn't a website where we can just continuously push in real-time.  We're talking about patching 2.5 billion clients, including tens of thousands of enterprise organizations.  That's not to mention the logistics involved in pushing ~50 petabytes of data in 24 hours. 

We understand that this is causing you pain, and we're not happy about it either.  We also don't want to put you in this position again, so we hope that you'll actively take advantage of the availability of our beta releases for proactive testing and bug reporting.  I realize that answer is probably not satisfactory for you, but the reality is that this doesn't meet our rubric for an out of band release.  We're doing this right, taking the time required, and are on track to land a fix in the next scheduled public release.  Hopefully you find the context useful, or at least interesting.