I don't remember the details, roughly it was unexpected invocation of move semantic, causing use after free in a loop.

My all-time favourite example is (again, my memory, I may be a bit wrong):

    for (int i = 0; i < (size_t)limit; ++i) {
    }

at some point limit could potentially become greater than INT_MAX, the compiler decided that i<limit could never be true because that would cause signed int overflow which is UB, so it "optimized" the loop into

   while(true)

signed unsigned mismatch makes me shiver