a super obvious dangling pointer to locals. clang++
does warn you not to do this, but it doesn't care enough to stop you.
on my machine, with whatever version of clang i have, this does the extremely funny behavior of reading into the caller's stack frame and then into env vars. you may or may not be this lucky, it might just segfault or something. who can say!