UseAfterFree.ql miss case 01

Hey, When I try to learn codeql dataflow analysis from UseAfterFree.ql, I found it miss handle some case like I mentioned in github slack. I just paste it at here:

This code can't handle by UseAfterFree.ql , I don't know why. I previouly think it should be caused by "flow after or before mis match"(Which I mentioned in github slack), But seems it's not the root cause . Because the UseAfterFree.ql always use as.Expr() which still handle some case. So I don't know how to inverstigate this one:

``` c++
#include
#include

struct MyStruct {
char* buf;
};

// Use-after-free of `buf` field.
static void test0100() {
struct MyStruct* s = (struct MyStruct*)malloc(sizeof(struct MyStruct));
s->buf = (char *)malloc(0x1000);
sprintf(s->buf, "kevwozere: %d\n", 100);
free(s->buf);
s->buf[0] = 0x41;
free(s);
}

int main() {
test0100();
return 0;
}
```