From "man realloc":
If ptr is NULL, realloc() is identical to a call to malloc() for size bytes.
I'm guessing that the original code uses realloc(NULL, size) to do the initial allocation, but your SSO means that the initial short string is part of the union, rather than dynamically allocated, but your code is passing a pointer to it to realloc() anyway.