The negative-length array trick is used in the Linux kernel source code [1]. I expect it's compiled with -Wvla though.
[1] https://github.com/torvalds/linux/blob/v4.5/arch/x86/boot/bo...
[0] - ISO 9899:2011 Programming Languages - C 6.7.6.2 4