This was something that kept me up at night in the run-up to Rust 1.0 and beyond (dreadful memories of the leakpocalypse), but so far we seem to have been quite lucky in that nobody has yet discovered a dramatic and fundamentally damning soundness flaw (and the progress of formal verification since 1.0 has increased confidence somewhat in the absence of such a flaw, but `Pin` represents a rather hairier increase in surface area than is usual... fingers crossed :P ).