I can take an address of an rvalue by binding in to a reference (which itself, as I understand, can only be referred to by an lvalue).
Is there any way to get rvalue that I can directly take an address of (i.e. like &(<rvalue>) would be a valid expression, without overriding operator&())?
Or maybe such is at least possible through 'binding' to another rvalue? (This does not seems to be the case as we can only 'bind' to references which are lvalues, see above. But maybe I'm missing some similar concept here.)
The more general question I'm trying to answer is whether the following is true: rvalues strictly correspond to a set of expressions that one can directly take an address of, except lvalue bitfields and maybe some other such 'special' kinds of lvalues.
A nested-name-specifier that denotes a class, optionally followed by the keyword
template([temp.names]), and then followed by the name of a member of either that class ([class.mem]) or one of its base classes, is a qualified-id; [class.qual] describes name lookup for class members that appear in qualified-ids. The result is the member. The type of the result is the type of the member. The result is an lvalue if the member is a static member function or a data member and a prvalue otherwise.
That is, creating a pointer-to-member to a non-static member function is applying the & operator to a prvalue.