I think I'd rather see this use the new `output` matcher rather than mocking:

``` ruby
expect {
  allow(hash).to receive(:rand).and_call_original
}.not_to output.to_stderr
```

The mock expectation is more brittle as it assumes a warning implementation that calls `warn` on the object itself when in fact `warn` can be called on any object (or even directly on Kernel) in order to produce a warning.