https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64632
--- Comment #2 from Jonathan Wakely <redi at gcc dot gnu.org> --- This just does the same std::ios_base::_M_streambuf_state member directly rather than through the basic_ios<char>::rdstate() member function (compile with -fno-access-control) #include <fstream> int main() { std::ofstream f; std::ios_base& base = f; return base._M_streambuf_state; } ub.cc:6:15: runtime error: member access within address 0x7fff3d4e47e8 which does not point to an object of type 'ios_base' 0x7fff3d4e46f0: note: object is base class subobject at offset 248 within object of type 'std::basic_ofstream<char, std::char_traits<char> >' 00 00 00 00 f8 c2 37 36 c2 7f 00 00 40 c1 37 36 c2 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ I don't see how this can possibly go wrong ... it just accesses a member of a base class. It makes no difference if you don't use the reference to base: std::ofstream f; return f._M_streambuf_state; Or use a pointer instead of reference: std::ofstream f; std::ios_base* base = &f; return base->_M_streambuf_state; I don't think this is a libstdc++ issue.