Get variable address in unsafe mode