Dereference a NULL pointer and use the result to initialize a reference. Sure, it's undefined behavior, but so are all the problems that result from NULL pointers, and in practice it doesn't crash until you "dereference" the reference by looking at the value, so it's probably as hard to track down as a NULL pointer crash.