Example 2 in Unsafe3 is not UB by Miri with tree-borrows about rust-quiz HOT 4 OPEN

// UB under stack borrows

//+ TB: NOT UB (Delayed initialization)
//+ Common pattern, it would be PREFERABLY NOT UB.
let val = [1u8, 2];
                                     // --- val: [Active, Active]
let ptr = &val[0] as *const u8;
                                     // --- val: [Active, Active]
                                     //     |--- ptr: [Frozen, Frozen?]
let _val = unsafe { *ptr.add(1) };
                                     // --- val: [Active, Active]
                                     //     |--- ptr: [Frozen, Frozen]

// v.get_unchecked_mut(n)

unsafe impl<T> SliceIndex<[T]> for usize {
    #[inline]
    unsafe fn get_unchecked(self, slice: *const [T]) -> *const T {
        assert_unsafe_precondition!(
            check_language_ub,
            "slice::get_unchecked requires that the index is within the slice",
            (this: usize = self, len: usize = slice.len()) => this < len
        );
        // SAFETY: the caller guarantees that `slice` is not dangling, so it
        // cannot be longer than `isize::MAX`. They also guarantee that
        // `self` is in bounds of `slice` so `self` cannot overflow an `isize`,
        // so the call to `add` is safe.
        unsafe {
            // Use intrinsics::assume instead of hint::assert_unchecked so that we don't check the
            // precondition of this function twice.
            crate::intrinsics::assume(self < slice.len());
            slice.as_ptr().add(self)
        }
    }
    #[inline]
    unsafe fn get_unchecked_mut(self, slice: *mut [T]) -> *mut T {
        assert_unsafe_precondition!(
            check_library_ub,
            "slice::get_unchecked_mut requires that the index is within the slice",
            (this: usize = self, len: usize = slice.len()) => this < len
        );
        // SAFETY: see comments for `get_unchecked` above.
        unsafe { slice.as_mut_ptr().add(self) }
    }
}