Thanks to @npostavs, I decided to rebuild Emacs from master. That is
GNU Emacs 26.0.50 (build 1, x86_64-pc-linux-gnu, GTK+ Version 3.22.15) of 2017-06-10
Should Emacs use the GNU version of malloc? no (only before dumping)
Should Emacs use a relocating allocator for buffers? no
Should Emacs use mmap(2) for buffer allocation?...
From the docstring of memory-use-counts, emphasis mine:
Return a list of counters that measure how much consing there has been.
Each of these counters increments for a certain kind of object.
The counters wrap around from the largest positive integer to zero.
Garbage collection does not decrease them.
So this is the expected output. I couldn't ...
but what happens when by pure chance a block of memory stores a valid Elisp object even when it is not supposed to be one?
Emacs conservatively marks the stack, which means that it examines each word on the stack and considers whether it "looks like" a Lisp object. There is a comment in alloc.c that explains the general approach:
/* Conservative C stack ...
General-purpose weak references would indeed be a useful general-purpose feature for elisp.
It's worth mentioning that in lieu of that functionality, there's a mini convenience library for exactly the strategy you mention (using a hash table with weak values and a single constant as a key) to obtain an effective weak reference: elisp-weak-ref.