See the case made by @stefanpenner in tc39/proposal-cancelable-promises#52

In many situations, a long-lived cancellation token (passed in by the caller) is combined with a short-lived token, e.g. in the "last" example or for a timeout:

function withTimeout(action, t) {
    return function(...args) {
        const token = args.pop();
        const timeout = new CancelToken(cancel => setTimeout(cancel, t, "timeout"));
        return action.call(this, ...args, token.concat(timeout));
    };
}

When the action is long over, and the combined token is no longer relevant to anyone, the token still holds are reference to it.
Todo:

• ensure that it is dropped, or at least not more than a constant amount of references are kept (though not ideal for tree-like dependencies).
• write refcounting test