The other answer correctly address the how does this program segfault
part of your question. However, I feel that the real question Redirecting stderr to stdout using string stream..
deserves a better answer:
You may simplify the whole shebang and make it scale and perform a infitely better better by just aliasing cerr to cout:
#include <iostream>
int main()
{
std::cerr.rdbuf(std::cout.rdbuf());
std::cerr << "this goes to cerr";
}
If you really want to be explicit:
std::cerr.copyfmt(std::cout);
std::cerr.clear(std::cout.rdstate());
std::cerr.rdbuf(std::cout.rdbuf());
You can verify that the text is actually received on stdout when run