It's explicitly allowed to create an array with 0 elements using a
new-expression, but the standard doesn't seem to explain the meaning of the
returned pointer.

As I see it, the most literal reading of the standard is the following: the
new-expression creates an array object with 0 elements. Because an object
can't have size 0, this empty array will have some nonzero
implementation-defined size. The pointer that's returned by the
new-expression points to this array. Since a pointer value is exactly one
of {null, pointer to object/function, pointer past the end, invalid}, and
this pointer does point to the array, it is not a past-the-end pointer.

Perhaps it was intended for this pointer to be in the past-the-end
category, but the current wording doesn't seem clear enough.

-- 
*Brian Bi*