Two independent soundness problems, both reachable from safe Rust.

Map::into iter drops builder (the caller-supplied hasher H) and incin by hand, then commits the ownership transfer with mem::forget(self). H::drop is user code and may panic. If it does, mem::forget(self) is skipped and the still-live Map unwinds, whose field drop glue destroys builder a second time. An empty map is enough — no entries or concurrency required.

SharedIncin::clear writes mem::uninitialized::<Arc< >>() into self.inner before taking the real Arc out. Arc has a validity invariant, so this is undefined behaviour at the point of creation, with no panic or concurrency involved. Between that write and the repairing one, self.inner also holds garbage while self is still droppable, so an unwind from incin.clear() or Arc::new decrements a refcount through an uninitialized pointer. The make shared incin! macro is instantiated five times, so this covers queue, stack, map, channel::spmc and channel::mpmc.

No fixed release is available. The crate has had no release since 2018-11-18 and the maintainer has not responded to the report.