Proposed resolution:

Add after the first sentence of [util.smartptr.getdeleter]/1:

The returned pointer remains valid as long as there exists a shared_ptr instance that owns d.

[Note: it is unspecified whether the pointer remains valid longer than that. This can happen if the implementation doesn't destroy the deleter until all weak_ptr instances in the ownership group are destroyed. -- end note]

The description of ~shared_ptr doesn't say when the shared_ptr's deleter, if any, is destroyed. In principle there are two possibilities: it is destroyed unconditionally whenever ~shared_ptr is executed (which, from an implementation standpoint, means that the deleter is copied whenever the shared_ptr is copied), or it is destroyed immediately after the owned pointer is destroyed (which, from an implementation standpoint, means that the deleter object is shared between instances). We should say which it is.