Use case #1
Issue was fixed in new commit but the version in the package's composer.json file has not been updated.
Example: https://www.drupal.org/project/geshifilter/issues/2932844#comment-13265195
"geshi/geshi": "dev-master#ed9f49a7c7a195f6ed2bc864f5ce03b990b5867d as v1.0.9.0",
Use case #2
Targeted version/tag was removed, package not found.
Example: https://github.com/minkphp/MinkSelenium2Driver/issues/313#issuecomment-528388652
"behat/mink-selenium2-driver": "dev-master#8684ee4 as 1.3.x-dev",
More
The 2 examples above are usages of Require Inline Alias, and there is another type of Alias called Branch Alias, see https://getcomposer.org/doc/articles/aliases.md