Csmith will sometimes still generate programs which take the address of a union field, even when the --take-no-union-field-addr option is used:
/*
* This is a RANDOMLY GENERATED PROGRAM.
*
* Generator: csmith 2.4.0
* Git version: 0ec6f1b
* Options: --max-array-dim 5 --max-array-len-per-dim 20 --no-longlong --no-packed-struct --take-no-union-field-addr
* Seed: 1438579922
*/
The program generated with the above options will use the address of a union field in several places.