What is the security issue here? In any case memory references don't work like that in web assembly: they are objects the runtime manages. This isn't assembly, despite the name. Your pointer UB will be inside the sandbox and nowhere else.