It stores them in an std::map, which can be (and often is) reallocated. Reallocation events in the map family invalidate existing storage.

It’s also not using objc_loadWeak under the assumption that zeroing weak references are zeroed at the time of deallocation instead of at time of load.