core::iter::repeat_n currently unconditionally derives Clone. However,
it will also drop its inner object if n is 0, which can cause a UAF if it's cloned afterwards.

use std::rc::Rc;
fn main() {
    let mut c = [0; 100];
    let x = std::iter::repeat_n(Rc::new(0), 0);
    let y = Box::new(&mut c);
    for _ in 0..100 {
        _ = x.clone();
    }
    y.fill(0);
}

Running the above program segfaults:

Exited with signal 11 (SIGSEGV): segmentation violation
Standard Error
   Compiling playground v0.0.1 (/playground)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.42s
     Running `target/debug/playground`

Edit: Made the segfault quicker/more reliable.