Agreed it is not likely to hit many people in production, but the writeup on the oss-security post, linked to below is a fascinating reminder of deeply buried assumptions buried, that make security hard.