better explain where the dynamic type of the pointee matters

Author: RalfJung

src/behavior-considered-undefined.md

@@ -71,11 +71,13 @@ Please read the [Rustonomicon] before writing unsafe code.
   * A `!` (all values are invalid for this type).
   * An integer (`i*`/`u*`), floating point value (`f*`), or raw pointer obtained
     from [uninitialized memory][undef], or uninitialized memory in a `str`.
-  * A reference or `Box<T>` that is [dangling], misaligned, or points to an invalid value.
+  * A reference or `Box<T>` that is [dangling], misaligned, or points to an invalid value
+    (using the actual dynamic type of the pointee as determined by the vtable in
+    the metadata in case of dynamically sized types).
   * Invalid metadata in a wide reference, `Box<T>`, or raw pointer. The requirement
     for the metadata is determined by the type of the unsized tail:
     * `dyn Trait` metadata is invalid if it is not a pointer to a vtable for
-      `Trait` that matches the actual dynamic type the pointer or reference points to.
+      `Trait`.
     * Slice metadata is invalid if the length is not a valid `usize`
       (i.e., it must not be read from uninitialized memory).
       Furthermore, for wide references and `Box<T>`, slice metadata is invalid