I switched to MSVC and the issue seemingly disappeared; Address Sanitizer still finds no issues. Using my own array class in place of std::string and std::filesystem::path works too.

I don't know if I should trust my own findings (maybe a gcc bug?) or I just keep winning the heap corruption lottery after switching to MSVC.