Don't use transmute to convert Arc from/to pointers. Use from_raw/into_raw instead.
Here's the use-after-free case.
thread 1: calls load()
thread 1: loads address A
thread 2: calls swap()
thread 2: address A is replaced with address B
thread 2: drops Arc from address A, which happens to be the last reference so it deallocate the Arc.
thread 1: calls Arc::clone() on Arc from address A
thread 1: trying to update reference counter on deallocated heap memory.
It was really the twisty maze of generics that I don't like about the implementation of arc-swap. It is frustrating tha the implementationt an ArcSwap is split among four different data structures divided between three modules. I can't hold all that in my head in order to understand what it's doing, andi haven't even yet located the actual code that avoids the data race.
I expect with ten minutes of effort I could manage to read and comprehend the code, but I haven't had that much uninterrupted time since starting to look into this.