It's not so critical as it could be, but it's still UB and should be fixed. But how it may work:
How usually (compiler depended) new[]/delete[] work:
new[] allocates a block with a needed size + a space for size - a number of objects.
delete[] extracts a size from the block and calls a destructor for each object and deallocates the block.
But! u8 is a basic type, not an object. So a compiler may replace new[] by new for basic types or use another trick, especially in case all actions are in the same place and the compiler knows a storing object. Also we have own pool and arena for some cases.
Not all, i.e. clang-802.0.42 doesn't detect it for basic types (for N5 too), only for objects, even without -O0+. Probably because of the trick above.
We had an option for it sometime ago, if I'm not mistaken. It was called --enable-address-sanitizer. It'd good to add a regular (1 per week) build on Jenkins.