An issue exists in the scratchpad crate prior to 1.3.1 for Rust. The move_elements function can have a double-free upon a panic in a user-provided f function.
scratchpad project scratchpad