> I think it's unsafe. The address of a pointer should not be used once the pointer has been freed.

Dereferencing a freed pointer is unsafe. A pointer is just an address,
there's nothing inherently unsafe with comparing a pointer with a
value. The only thing that could go wrong is if the same address was
reused in between which could end up screwing your code logic, but
since here the TLS can only be set by the current thread, I think it's
perfectly safe.

> How about we reverse the order? At first we remove the key from TLS and then free the tstate.

Looks good to me!