The leave instruction is equivalent to:
mov esp, ebp
The second instruction pops the value on the top of the stack and stores it in ebp. In the case of a stack-based buffer overflow, your stack layout looks like:
<--- low addresses high addresses --->
[ buffer being overflowed ][saved EBP][RET ADDR]
For the CPU, ebp (and even esp most of the time) are not really different from eax, ebx and other registers. They can contain any data, not necessarily valid addresses. You only get problems (faults/exceptions) if you actually try to execute instructions that use those registers as addresses (directly or indirectly), or, in case of ESP, an interrupt happens.
Currently it is not supported to do debug automation in callbacks. This is related to the threading model and is further explained at https://x64dbg.com/blog/2016/10/20/threading-model.html, which links to some older resources.
Recently there was an interesting development though, because it became possible to automate in the debug callbacks with x64dbg’s ...