>>> How so? c1 is a punned reference to u, and c2 is a punned reference to
>>> u.i, so [basic.lval]/11 applies, does it not? Meanwhile, reading u.c
>>> for c3 would access an inactive variant.
>>
>> 'u.c' is pointer-interconvertible with 'u' (and 'u.i'), so '(char&)u'
>> refers to 'u.c'.
>
> Pointer-interconvertibility is always a relationship between two
> objects ([basic.compound]/4). If u.c exists, then the object u.c is
> pointer-interconvertible with the object u. But in this case, the only
> existing objects are u and u.i; the data member u.c does not refer to
> an object.

What is u.c then, an «empty lvalue»?)))))))))))))
u.c denotes an out-of-lifetime object.

> More generally, if such a conversion could ever result in a pointer or
> reference to (the storage corresponding to) an inactive data member,
> then there could be ambiguity regarding *which* data member the
> pointer or reference actually refers to, in cases where multiple data
> members have the same type.

Known issue (well, here «known» ≠ «has CWG number»)