Question: why does the evaluation inside a[] (which does not produce a value) not result in a bad array subscript error in this case?

if you try to evaluate this kind of things as an arithmetic expression directly, it will fail with an error of a bad subscript (mind you, the attack will still work though).