System programming languages usually provide pointers so as to permit efficient and understandable programs to be written. Some higher level languages either avoid pointers altogether or greatly circumscribe pointers to guarantee safety, i.e., so that programs cannot gain access to storage in an inappropriate way. By combining the ideas of 1) pointer scope front Algol 68, 2) tombstones for invalidating dangling references, and 3) freezing which permits freeable objects to have scoped pointers, we solVe the problem of providing convenient and efficient pointers while simultaneously guaranteeing safety.