How to use associative arrays safely inside arithmetic expressions?

A few Bourne-like shells support associative arrays: ksh93 (since 1993), zsh (since 1998), bash (since 2009), though with some differences in behaviour between the 3. A common use is for counting occurrences of some strings. However, I find that things like:

typeset -A count
(( count[$var]++ ))

Don't work for some values of $var and I hear it even constitutes an __*arbitrary command execution* vulnerability__ if the contents of $var is or may be under the control of an attacker. Why is that? What are the problematic values? And how do I work around it?