I filed QTBUG-123878 yesterday, incorrectly, as nothing was wrong with QString. However, I have now tracked down the uninitialized memory read to QRegularExpression and attached a reduced reproduction that uses just QString and QRegularExpression.

For the attached regexp and (SVG) text content triggers valgrind warnings. The reproduction executable will trigger this both in Debug and Release builds.

In this case, it looks like no harm is done and the regexp simply returns no matches. Hard to say whether this is exploitable in some other way though.