Issue 1:
I make no claims about whether or not the code below should compile. But the compiler probably shouldn't panic.

use std::sync::mpsc::channel;
use std::io::timer::Timer;
use std::time::Duration;
use std::thread::Thread;
use std::sync::{Arc,Semaphore, SemaphoreGuard, TryLockResult};

pub struct SemaphoreTimeout {
#[experimental]
pub semaphore: Semaphore
}

impl SemaphoreTimeout {
pub fn try_acquire(&self, duration: Duration) -> TryLockResult<SemaphoreGuard> {
let (tx,rx) = channel::<()>();
let mut timer = Timer::new().unwrap();
let timeout = timer.oneshot(duration);
let mut itemPtr : *mut Semaphore;
unsafe {
let itemPtr : *mut Semaphore = std::mem::transmute(self.semaphore);
}
let itemSendablePtr = std::ptr::Unique(itemPtr);

let mut guard : Option<SemaphoreGuard> = None;
let guardPtr : *mut Option<SemaphoreGuard> = &mut guard;
let sendablePtr = std::ptr::Unique(guardPtr);
Thread::spawn(move |:| {
unsafe {
let sema = *(itemSendablePtr.0);
*(sendablePtr.0) = Some(sema.access());
}
tx.send(()).unwrap();
});

loop {
select! {
val = rx.recv() => {
return Ok(guard.unwrap());
},
_ = timeout.recv() => {
return Err(std::sync::TryLockError::WouldBlock);
}
}
}

}
}

#[test]
fn it_works() {
let total_time = std::time::duration::Duration::span(|| {
let sema = SemaphoreTimeout{ semaphore: Semaphore::new(0)};
sema.try_acquire(Duration::seconds(10));
}).num_seconds();
assert!(total_time > 9);

}

$ RUST_BACKTRACE=1 rustc --crate-type rlib src/lib.rs
src/lib.rs:20:64: 20:68 error: cannot move out of borrowed content
src/lib.rs:20 let itemPtr : *mut Semaphore = std::mem::transmute(self.semaphore);
^~~~
src/lib.rs:30:41: 30:45 error: `sema` does not live long enough
src/lib.rs:30 *(sendablePtr.0) = Some(sema.access());
^~~~
note: reference must be valid for the static lifetime...
src/lib.rs:28:13: 31:14 note: ...but borrowed value is only valid for the block at 28:12
src/lib.rs:28 unsafe {
src/lib.rs:29 let sema = *(itemSendablePtr.0);
src/lib.rs:30 *(sendablePtr.0) = Some(sema.access());
src/lib.rs:31 }
src/lib.rs:29:28: 29:49 error: internal compiler error: this path should not cause illegal move
src/lib.rs:29 let sema = *(itemSendablePtr.0);
^~~~~~~~~~~~~~~~~~~~~
note: the compiler unexpectedly panicked. this is a bug.
note: we would appreciate a bug report: http://doc.rust-lang.org/complement-bugreport.html
note: run with `RUST_BACKTRACE=1` for a backtrace
thread 'rustc' panicked at 'Box<Any>', /Users/drew/Code/rust/src/libsyntax/diagnostic.rs:130

stack backtrace:
1: 0x111354dbc - sys::backtrace::write::h3b1687d123840745dbu
2: 0x111378cef - failure::on_fail::h4f27fcb787f34dcb8aB
3: 0x1112e2c0e - rt::unwind::begin_unwind_inner::h1d4bab16a9a9da184SA
4: 0x110a83f8f - rt::unwind::begin_unwind::h4217311381055978755
5: 0x110a83f24 - diagnostic::SpanHandler::span_bug::hd5501efc6390fb73vYE
6: 0x10e3f5995 - session::Session::span_bug::h4a1e9356937820aeTxo
7: 0x10e3720e4 - borrowck::build_borrowck_dataflow_data::hd89794399b269c02lPe
8: 0x10e36d9b8 - borrowck::borrowck_fn::hf2a6eb5420fa3465IMe
9: 0x10e36fee9 - visit::walk_expr::h2260093690797296160
10: 0x10e36f96b - visit::walk_expr::h2260093690797296160
11: 0x10e36e22d - borrowck::borrowck_fn::hf2a6eb5420fa3465IMe
12: 0x10e370c28 - visit::walk_method_helper::h8676194234672418769
13: 0x10e36eccc - borrowck::borrowck_item::h58249352ae407815GLe
14: 0x10e36ee9f - borrowck::check_crate::h88841bf41bd69ee3yGe
15: 0x10db0354a - driver::phase_3_run_analysis_passes::h875fa1a74376223cVFa
16: 0x10dae84e6 - driver::compile_input::h2c7c782afbb2d5e3Bba
17: 0x10dba7216 - run_compiler::h134233be72a5f033R8b
18: 0x10dba4563 - thunk::F.Invoke<A, R>::invoke::h11706971136093431084
19: 0x10dba33c8 - rt::unwind::try::try_fn::h10954395397093774028
20: 0x1113f0d09 - rust_try_inner
21: 0x1113f0cf6 - rust_try
22: 0x10dba3a06 - thunk::F.Invoke<A, R>::invoke::h15388688857395276920
23: 0x111364681 - sys::thread::thread_start::h75057efc72f2c7edr3w
24: 0x7fff8d1e62fc - _pthread_body
25: 0x7fff8d1e6279 - _pthread_body

$ rustc --version
rustc 1.0.0-dev (d15192317 2015-01-25 16:09:48 +0000)

Issue 2:
Input:

struct T(u8);

fn t() -> *mut T {
unsafe { 0u8 as *mut T }
}

fn main() {
let a = unsafe { *t() };
}

Output:

$ rustc ../test.rs
../test.rs:9:19: 9:23 error: internal compiler error: this path should not cause illegal move
../test.rs:9 let a = unsafe { *t() };
^~~~
note: the compiler unexpectedly panicked. this is a bug.
note: we would appreciate a bug report: http://doc.rust-lang.org/complement-bugreport.html
note: run with `RUST_BACKTRACE=1` for a backtrace
thread 'rustc' panicked at 'Box<Any>', /Users/John/Documents/dev/rust/src/libsyntax/diagnostic.rs:123

stack backtrace:
1: 0x10f825b75 - sys::backtrace::write::h757d4037fec4513elCt
2: 0x10f84800f - failure::on_fail::he99e1d2cd81a67a80Hz
3: 0x10f7b3c8a - rt::unwind::begin_unwind_inner::hede15ebc165353e0Qpz
4: 0x10d508707 - rt::unwind::begin_unwind::h5150449308391082809
5: 0x10d50869c - diagnostic::SpanHandler::span_bug::h1cc7aa850b4525b9nQF
6: 0x10c93bc1d - session::Session::span_bug::h9dff6f0c981e0b95mRq
7: 0x10c547999 - borrowck::build_borrowck_dataflow_data::hbfab9f3785e58ec8QRe
8: 0x10c5432fb - borrowck::borrowck_fn::h9d4d5a57ec1e26a2cPe
9: 0x10c5440f2 - borrowck::borrowck_item::hd3de64f0b51b624a9Ne
10: 0x10c54461f - borrowck::check_crate::hab49ad1d67fb67e9ZIe
11: 0x10c09e8aa - driver::phase_3_run_analysis_passes::h3bf5eb3f470c8788gwa
12: 0x10c082d90 - driver::compile_input::h63293298907e332cxba
13: 0x10c14e7ba - monitor::unboxed_closure.22558
14: 0x10c14cf15 - thunk::F.Invoke<A, R>::invoke::h15985566512806182469
15: 0x10c14bcf0 - rt::unwind::try::try_fn::h5957420952141477940
16: 0x10f8b1189 - rust_try_inner
17: 0x10f8b1176 - rust_try
18: 0x10c14c3ec - thunk::F.Invoke<A, R>::invoke::h12578415658120090831
19: 0x10f835814 - sys::thread::thread_start::he6c5dcba45c95bf2drw
20: 0x7fff933e22fc - _pthread_body
21: 0x7fff933e2279 - _pthread_body