We only used the constant indexes for illustration. The system checks, at compile time, that values that are controlled by the attacker (e.g. inputs) are proper

We only used the constant indexes for illustration. The system checks, at compile time, that values that are controlled by the attacker (e.g. inputs) are properly sanitized. See this: http://goto.ucsd.edu:8090/index.html#?demo=permalink%2F1401418498.hs http://goto.ucsd.edu:8090/index.html#?demo=permalink%2F14014... that uses Lists instead of pointers, for a short example.