Is this homework?

One possible example I can think of, is if there is a struct of a known size, and you want to find it, you can allocate a block of the same size, and get a ptr that is near it?

Also, if you know of a function vulnerable to buffer overruns, you can place data near the input for a given buffer as long as you know its size and therefore control what the vulnerable function reads.,