Sorry for bringing this up again, but this could work:
void foo(int x, int (*s)[x])
{
(*s)[x] = 1; // <- undefined behaviour
}
Such an access beyond the specified length means that either
1. the array is accessed out-of-bounds or
2. was accessed using an incompatible pointer
and a compiler would be allowed to catch this.
Martin