Because the allocation memory address patterns are pretty predictable, heap overflows can be used to modify state in an object known to be very probably adjacent. Even read overflows enable the attacker to read the required state to make some other exploit reliable.

Double free implies the attacker can control victim object's memory through another object (which the attacker can somehow influence) occupying the same addresses in memory.

So the attacker can now carefully craft state that causes the desired (=bad) behavior in the original buggy object. Or to use it to learn something about the buggy object's state, like code locations in memory (= reading C++ virtual method pointers / function pointers directly or indirectly) possibly leading to defeating ASLR and other protection mechanisms. This leads into various exploit scenarios.

Hopefully I explained this well enough... it's pretty straightforward really. Especially if you step through in a debugger.

Double frees (and use after frees!) can be very dangerous.