Does the following undefined behavior occur if the pointer used to access the member pointer is of the correct type?
No, he is well formed. Rule from [expr.mptr.oper] :
If the dynamic type E1 does not contain the member to which E2 belongs, the behavior is undefined.
The dynamic type *this is the subone that contains the element, so this is normal.
And if so, why do I need a listing?
, , . , , . , .
. ( , ..) a Derived* Base*. , . Base* Derived*... Derived*. , - , . , , .