...
When part of the operand of the sizeof operator is a VLA type and when changing the value of the VLA's size expression would not affect the result of the operator, it is unspecified whether or not the size expression is evaluated. See unspecified behavior 22 in Annex J (Section J.1) of the C standard [ISO/IEC 9899:2011].
Providing an expression that appears to produce side effects may be misleading to programmers who are not aware that these expressions are not evaluated in the non-VLA case and have unspecified results otherwise. As a result, programmers may make invalid assumptions about program state, leading to errors and possible software vulnerabilities.
...
CERT C++ Secure Coding Standard: EXP06-CPP. Operands to the sizeof operator should not contain side effects
ISO/IEC 9899:2011 Section Section 6.5.3.4, "The sizeof and _Alignof operators"
...