After a minor GC we should do a normalish mark to check for object pointers which are now pointing at swept nursery. One caveat is that the mark stack looses all information about the path followed to the object, which rather defeats the purpose. What I'd like to do here is check poisoning in MarkInternal and either longjump or otherwise escape to the top level where we can safelyish scan the heap to try and backtrack the path from the poisoned pointer to a root. Hopefully a path will make it easier to identify the user code, which should point us at the mechanism, which should make it possible to identify the buggy implementation.