Why do you say you should only get a memory leak? It's undefined behavior; anything can happen.
The problem is probably because the virtual destructor also serves to determine the deallocation function and the address to pass to it. In your case, you end up passing the wrong address to ::operator delete
. But that's just what is probably happening in practice. It's undefined behavior, and anything can happen.