I don’t know, but I suspect…
ln -s doesn’t require the target to exist.
So that command creates a broken link to a file named abort:true, the file obviously does not exist, but the stored information is in the name of the file.
This is what I read:
Upon the first call to the malloc(3) family of functions, an initial- ization sequence inspects the symbolic link /etc/malloc.conf, next checks the environment for a variable called MALLOC_OPTIONS, and fi- nally looks at the global variable malloc_options in the program. Each is scanned for the following flags. Flags are single letters. Unless otherwise noted uppercase means on, lowercase means off.
So it doesn’t read a file (the link is pointing to), but inspects the symbolic link.