I'm not sure about the bounds sanitiser, but the address sanitiser is not meant to be used as a hardening mechanism and allows trivial exploits:

http://seclists.org/oss-sec/2016/q1/363