Much, much more subtly nasty, it's also legal for NULL to be defined as:

  #define NULL ((void*)0)

and then passed to a function that expects variadic int* parameters on a machine where register-sized addresses are word-aligned and thus int* has a different sizeof (and/or bit-level representation) than void*.