The Problem with C++ Safety: Why "It Works" Isn't Good Enough