I'm not sure I see it as "taking advantage of"; if code is engaging in the UB of writing to invalid pointers, there could still have a race condition where call

I'm not sure I see it as "taking advantage of"; if code is engaging in the UB of writing to invalid pointers, there could still have a race condition where calloc() appears to be returning non-zeroed memory, simply because the invalid pointer write happened after the clear. This just moves the clear back in time.