There are a few places in Rust and its stdlib that people seek to validate with formal methods, but usually these efforts are first focused on proving fundamental pieces (such as std::pin https://doc.rust-lang.org/std/pin/index.html , which I believe has been integrated into Ralf Jung's formal model), and only later on outlying APIs such as this (the rationale being that fundamental APIs would be enormously more disruptive to fix if unsoundness should be discovered).

As to your conclusion though, obligatory shout-out to Huon Wilson, who discovered the one other instance of unsoundness in a newly-stabilized API (this one due to a typo, therefore much simpler to resolve), mere hours after the stable release of Rust 1.15: https://www.reddit.com/r/rust/comments/5roiq7/announcing_rus... :)

Could be it just came across the right pair of eyes. It's quite reminiscent of the old EvilIx problem in Haskell, where you can break memory safety without doing anything explicitly marked unsafe: https://mail.haskell.org/pipermail/haskell-cafe/2006-Decembe...