Rationale (August, 2010):

Access applies to use of names, so the check must be done at the point at which the pointer-to-member is formed. It is not possible to tell from the pointer to member at runtime what the access was.

The restrictions on protected access in 11.8.5 [class.protected] apply only to forming pointers to members and to member access expressions. It should be considered whether to extend these restrictions to pointer-to-member expressions as well. For example,

   struct base {
       protected: int x;
   };

   struct derived : base {
       void foo(base* b) {
          b->x = 123; // not ok
          (b->*(&derived::x)) = 123; // ok?!
       }
   };