I am referring to this circuit:
As you know it is well known circuit for pre-synchronizing reset (reset bridge).
Looking into small details I imagine violation could occur on either flip1 or flip2 (probably not both).
If violation occurs on first flip then it got the second flip to absorp it, fair enough though not quite two stage synchronizer. But if violation occurred on second flip there is nothing we have done?
So how come it is viewed as safe?
If the reset signal deasserts near the clk edge then the first flop may not settle to a valid level before the next clock edge causing the second flop to also go metastable. The reset system may see some ambiguity as to which edge the reset deasserts on.
Will this work? Probably. If you knew the technology constants and clock rate then you would calculate the Mean time between failure (MTBF) to sure that a failure is expected once every "large number of centuries". If that's not good enough then add a third stage and centuries bumps up to millennia .