"..things that can be parsed as variable names are treated as variable names in arithmetic contexts. ..bash does this *recursively* until it gets to an integer, or to something that can't be parsed as either an integer or a variable name."
https://lists.gnu.org/archive/html/help-bash/2018-10/msg00008.html
OMG. This is _not_ documented.
I hope all the shell scripts in the world are sanitizing their inputs.
@gcb @rain@niu.moe @kingcons