/GS pointer subterfuge

Ok so after people complained of not having a valid code example for my previous post 'smoke & mirrors', here we go:

-- begin snip --

int main(void)
{
   meow();
   return 0;
}

void meow(void)
{
   int x;
   int *y;

   y = &x+3;
   *y = ((int )woot);

   return;
}

void woot (void)
{
   printf("owned\n");
   return;
}

-- end snip --

woot() is never called, but by pointer offset its address is used to overwrite EIP resulting in a jmp to it at the end of meow().. /GS does nothing.