<blockquote>There's a lot of code out there (e.g. Tk, Itcl) which uses this
feature, UBSan just reports false-positives for them.</blockquote>

One can use <tt>-fsanitize=undefined -fno-sanitize=function</tt>, but I doubt UBSan’s reports of undefined behavior are false positives*, despite things behaving as expected under typical calling conventions. Or have I misunderstood what you meant by “false positives”?

*(The only potential false positives I am aware of are those due to this feature’s reliance on name mangling, which is more strict than standard C type compatibility; see [https://reviews.llvm.org/D148827].)

That being said, I do not know how immediate any danger posed by optimizing compilers is for exploiting this type of undefined behavior. Instances within a single translation unit, or with LTO enabled, speculatively seem more concerning.