Document AnyLifetime is unsound

Summary: Using dtolnay example from [workplace](https://fb.workplace.com/groups/buck2eng/posts/2988664691431011).

Reviewed By: krallin

Differential Revision: D42516983

fbshipit-source-id: 839b8f0a67000b133154ddc4a116dfc1ed159155

gazebo/gazebo/src/any.rs

@@ -327,4 +327,15 @@ mod tests {
         #[derive(ProvidesStaticType)]
         struct FooBar<'x, P: My<'x>>(&'x P);
     }
+
+    #[test]
+    fn test_any_lifetime_unsound() {
+        fn _use_after_free(s: &mut &str) {
+            let ss = (s as &mut dyn AnyLifetime).downcast_mut().unwrap();
+            // We allocate a string here, but do not store it anywhere, so it is dropped.
+            // But the pointer to it is available in `s` at call site.
+            // This is use after free.
+            *ss = &".".repeat(40);
+        }
+    }
 }