With a little bit of hackery I can see smth like this:
$ cat b.cc 
int main() {
  int *p = 0;
  {
    int x = 0;
    p = &x;
  }
  return *p;
}
$ ./clang++ b.cc
$ ./a.out
$ ./clang++ b.cc -fsanitize=address -mllvm -asan-use-lifetime=1
$ ./a.out
=================================================================
==29643== ERROR: AddressSanitizer: use-after-poison on address 0x7fff861f4f80 at pc
0x403ed6 bp 0x7fff861f4e50 sp 0x7fff861f4e48
READ of size 4 at 0x7fff861f4f80 thread T0
    #0 0x403ed5 (/usr/local/google/llvm_cmake_clang/tmp/lifetime/a.out+0x403ed5)
    #1 0x7f7a40ec7c4c (/lib/libc-2.11.1.so+0x1ec4c)
Address 0x7fff861f4f80 is located at offset 160 in frame <main> of T0's stack:
  This frame has 4 object(s):
    [32, 36) ''
    [96, 104) 'p'
    [160, 164) 'x'
    [224, 228) ''
HINT: this may be a false positive if your program uses some custom stack unwind mechanism
      (longjmp and C++ exceptions *are* supported)
Shadow byte and word:
  0x1ffff0c3e9f0: f7
  0x1ffff0c3e9f0: f7 f4 f4 f4 f2 f2 f2 f2
More shadow bytes:
  0x1ffff0c3e9d0: 00 00 00 00 00 00 00 00
  0x1ffff0c3e9d8: 00 00 00 00 f1 f1 f1 f1
  0x1ffff0c3e9e0: 04 f4 f4 f4 f2 f2 f2 f2
  0x1ffff0c3e9e8: 00 f4 f4 f4 f2 f2 f2 f2
=>0x1ffff0c3e9f0: f7 f4 f4 f4 f2 f2 f2 f2
  0x1ffff0c3e9f8: 04 f4 f4 f4 f3 f3 f3 f3
  0x1ffff0c3ea00: 00 00 00 00 00 00 00 00
  0x1ffff0c3ea08: 00 00 00 00 00 00 00 00
  0x1ffff0c3ea10: 00 00 00 00 00 00 00 00
Stats: 0M malloced (0M for red zones) by 0 calls
Stats: 0M realloced by 0 calls
Stats: 0M freed by 0 calls
Stats: 0M really freed by 0 calls
Stats: 0M (0 full pages) mmaped in 0 calls
  mmaps   by size class: 
  mallocs by size class: 
  frees   by size class: 
  rfrees  by size class: 
Stats: malloc large: 0 small slow: 0
==29643== ABORTING

Certainly, I see no crash with -O1/-O2 :)

We need:
  1) make Clang emit llvm.lifetime.start intrinsic for a local variable declaration
(insert it between alloca for the variable and its initialization).
  2) make Clang emit llvm.lifetime.end intrinsic when variable goes out of scope.

Changes (1)-(2) seem to be pretty intrusive. We may enable them only for use-after-scope
sanitizer for now (expose this "sanitizer" as an optional part of -fsanitize=address,
support it in Clang driver etc).

  3) properly handle lifetime intrinsics in ASan pass. As a starting point, we may
just emit calls (or do equivalent of) __asan_poison_memory_region() for llvm.lifetime.end
and __asan_unpoison_memory_region() for llvm.lifetime.start AND before every return
instruction. There is much to do here to reduce redundant operations.

Note: you can work on the asan part in parallel with the clang part: just use the tests
with inlining as in the original bug report. 

Can we also add -fsanitize=use-after-scope and make the reports look like 
ERROR: AddressSanitizer: use-after-scope
?