Suppose I want to use the following simple hash function. For a mesage $m$, take some public $a$ and prime $p$ and raise $a^m \bmod p$ (never mind the computational expense of this operation).
This hash function is secure because the discrete log problem is hard, but only if $p-1$ has a large prime factor (to avoid being broken by index calculus). However, I figure if everyone's going to use the same $p$, I might as well choose $p$ so it's largest factor is as large as possible, in other words choose $p$ to be a Safe prime (meaning $\frac{(p-1)}{2}$ is also prime).
So how can I choose p to be a Safe prime, but also make it a Nothing-Up-My-Sleeve number for the purpose of constructing a good cryptographic hash protocol.
Then I'll choose $a$ to be the smallest generator $\bmod p$ (that's easy to check for Safe primes because all I need to do is find the smallest $a$ for which $legendre(a,p)=-1$).