Possible resolution:

Change in 7.3.2 [conv.lval] bullet 3.3 as follows:

The result of the conversion is determined according to the following rules:

• ...
• Otherwise, if the object to which the glvalue refers contains an invalid pointer value (6.8.6.5.3 [basic.stc.dynamic.deallocation]) a pointer value that is not valid in the context of the conversion (6.9.4 [basic.compound]), the behavior is implementation-defined.
• ...

(From submission #645.)

Issue 2822 clarified that pointer values are not replaced by invalid pointer values when the duration of the storage of their pointee ends, but merely become invalid in the context of evaluations outside of the duration of the storage. However, 7.3.2 [conv.lval] bullet 3.3 still reads:

The result of the conversion is determined according to the following rules:

• ...
• Otherwise, if the object to which the glvalue refers contains an invalid pointer value (6.8.6.5.3 [basic.stc.dynamic.deallocation]), the behavior is implementation-defined.
• ...