I think this is probably a duplicate of JDK-8054941, but it might be useful as another test case. This one doesn't involve lower bounds, or `null`.

The following program contains no casts and compiles cleanly with -Xlint:unchecked,rawtypes, but fails at runtime with a CCE:

```
abstract class T {

  public static void main(String[] args) {
    Box<String> a = new Box<>("hello");
    Box<Object> b = cast(a);
    b.set(42);
    System.err.println(a.get());
  }

  static class Box<T> {
    private T x;
    Box(T x) { this.x = x; }
    T get() { return x; }
    void set(T x) { this.x = x; }
  }

  static Box<Object> cast(Box<String> target) {
    return identity(flatten(new Box<Box<?>>(target)));
  }

  static <A> A identity(A x) {
    return x;
  }

  static <B> Box<? extends B> flatten(Box<Box<? extends B>> r) {
    return r.get();
  }
}
```

```
$ javac -fullversion
javac full version "11-ea+13"
$ javac -Xlint:all T.java
$ java T
...
Exception in thread "main" java.lang.ClassCastException: java.base/java.lang.Integer cannot be cast to java.base/java.lang.String
at T.main(JavacBug.java:7)
```