It's undefined behavior, regardless of whether there's virtual function or not. The standard says clearly,
If the prvalue of type "pointer to cv1 B" points to a B that is actually a subobject of an object of type D, the resulting pointer points to the enclosing object of type D. Otherwise, the result of the cast is undefined.