Strings created from the C API with a len but no ptr have a buffer allocated
and the length set, but the buffer is not zero'd. This causes use of uninitialized
memory and allows reading memory that previously existed there.

For example, the rb_str_tmp_new spec fails when we create a string with
a large length greater than 24 bytes (since we zero the first 24 bytes
of the slot).