Possible bug in Clang 3.0-6ubuntu

test.cc

#include <iostream>
#include <string>

struct Object {
    std::string field;
};

Object get1() {
    Object o;
    o.field = "Hello, World!";
    return o;
}

std::string get2(std::string Object::*field) {
    return get1().*field;
}

int main(void) {
    std::cout << get2(&Object::field) << std::endl;
    return 0;
}

Valgrind output

==6649== Memcheck, a memory error detector
==6649== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==6649== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info
==6649== Command: ./test
==6649== 
==6649== Invalid read of size 8
==6649==    at 0x4EC9063: std::basic_ostream<char, std::char_traits<char> >& std::operator<< <char, std::char_traits<char>, std::allocator<char> >(std::basic_ostream<char, std::char_traits<char> >&, std::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==6649==    by 0x400B6E: main (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==  Address 0x5a04040 is 0 bytes inside a block of size 38 free'd
==6649==    at 0x4C2A4BC: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==6649==    by 0x4ED51E2: std::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string() (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==6649==    by 0x400C54: Object::~Object() (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==    by 0x400C34: Object::~Object() (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==    by 0x400B2B: get2(std::string Object::*) (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==    by 0x400B60: main (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649== 
==6649== Invalid read of size 1
==6649==    at 0x53C8E52: _IO_default_xsputn (genops.c:485)
==6649==    by 0x53C6D89: _IO_file_xsputn@@GLIBC_2.2.5 (fileops.c:1393)
==6649==    by 0x53BC9FC: fwrite (iofwrite.c:45)
==6649==    by 0x4ECA574: std::basic_ostream<char, std::char_traits<char> >& std::__ostream_insert<char, std::char_traits<char> >(std::basic_ostream<char, std::char_traits<char> >&, char const*, long) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==6649==    by 0x400B6E: main (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==  Address 0x5a04058 is 24 bytes inside a block of size 38 free'd
==6649==    at 0x4C2A4BC: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==6649==    by 0x4ED51E2: std::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string() (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==6649==    by 0x400C54: Object::~Object() (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==    by 0x400C34: Object::~Object() (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==    by 0x400B2B: get2(std::string Object::*) (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==    by 0x400B60: main (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649== 
Hello, World!
==6649== Invalid read of size 4
==6649==    at 0x4ED519A: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==6649==    by 0x4ED51E2: std::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string() (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==6649==    by 0x400B97: main (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==  Address 0x5a04050 is 16 bytes inside a block of size 38 free'd
==6649==    at 0x4C2A4BC: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==6649==    by 0x4ED51E2: std::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string() (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==6649==    by 0x400C54: Object::~Object() (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==    by 0x400C34: Object::~Object() (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==    by 0x400B2B: get2(std::string Object::*) (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==    by 0x400B60: main (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649== 
==6649== Invalid write of size 4
==6649==    at 0x4ED51A0: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==6649==    by 0x4ED51E2: std::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string() (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==6649==    by 0x400B97: main (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==  Address 0x5a04050 is 16 bytes inside a block of size 38 free'd
==6649==    at 0x4C2A4BC: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==6649==    by 0x4ED51E2: std::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string() (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==6649==    by 0x400C54: Object::~Object() (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==    by 0x400C34: Object::~Object() (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==    by 0x400B2B: get2(std::string Object::*) (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==    by 0x400B60: main (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649== 
==6649== Invalid free() / delete / delete[] / realloc()
==6649==    at 0x4C2A4BC: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==6649==    by 0x4ED51E2: std::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string() (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==6649==    by 0x400B97: main (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==  Address 0x5a04040 is 0 bytes inside a block of size 38 free'd
==6649==    at 0x4C2A4BC: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==6649==    by 0x4ED51E2: std::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string() (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16)
==6649==    by 0x400C54: Object::~Object() (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==    by 0x400C34: Object::~Object() (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==    by 0x400B2B: get2(std::string Object::*) (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649==    by 0x400B60: main (in /home/ssd0/tim/scratch/clang-pointer-to-method/test)
==6649== 
==6649== 
==6649== HEAP SUMMARY:
==6649==     in use at exit: 0 bytes in 0 blocks
==6649==   total heap usage: 1 allocs, 2 frees, 38 bytes allocated
==6649== 
==6649== All heap blocks were freed -- no leaks are possible
==6649== 
==6649== For counts of detected and suppressed errors, rerun with: -v
==6649== ERROR SUMMARY: 17 errors from 5 contexts (suppressed: 2 from 2)