Any of the following will crash bash:
declare -n ref=a[*]; ref=
declare -n ref=a[@]; ref=
declare -n ref=a[-1]; a=(); ref=
declare -A A; declare -n ref='A[$unset]'; ref=
They all produce "bad array subscript" errors so could be caught.
==60597== Invalid read of size 4
==60597== at 0x100020BEE: bind_variable_internal (variables.c:2717)
==60597== by 0x1000392E3: do_assignment_internal (subst.c:3121)
==60597== by 0x10003F8D4: expand_word_list_internal (subst.c:3161)
==60597== by 0x100019094: execute_command_internal (execute_cmd.c:4105)
==60597== by 0x100017BF6: execute_command_internal (execute_cmd.c:2579)
==60597== by 0x10006A82E: parse_and_execute (evalstring.c:417)
==60597== by 0x1000032E7: run_one_command (in /Users/levit/utils/bin/bash)
==60597== by 0x100002502: main (shell.c:724)
==60597== Address 0x28 is not stack'd, malloc'd or (recently) free'd