How is the engine supposed to know that you access an invalid member? You just do some pointer shifting and then access something in an anonymous mass of memory.
That your script crashes is just the access of unmapped memory (thats the lucky case where you know something bad happens), but you can also overwrite everything else in the RAM that is mapped into your process.