Given that this involves memory allocation and the fact that it has to be triggered with a specific sequence of HTTP requests, does it mean that the possibilty of this happening is extremely rare? Any system on which this attempt is done probably needs to be having not many others processes running which might trigger memory allocations and thus break this specific set of steps to exploit the issue?

Not trying to belittle the issue or the efforts spent to report it, but trying to understand how frequently it could be exploited.