Improvement: include some static counter, and only skip the free after a few million (billion?) calls. If possible, also make the thing random, and limit skipping free to a limited range of block sizes. The latter provides a nice false trail for investigators (hm, it is leaking only struct foo...)

Problem of course is to find a nice size range for the program at hand.