A variable-length array

Why is this risky in firmware?

void log_frame(size_t len) {
    uint8_t tmp[len];
    /* ... */
}