As noted in the documentation for GCC's nested functions:
If you try to call the nested function through its address after the containing function exits, all hell breaks loose. If you try to call it after a containing scope level exits, and if it refers to some of the variables that are no longer in scope, you may be lucky, but it's not wise to take the risk.
In other words, what you're trying to do here — returning a reference to a nested function — is not really sanctioned by GCC. To whatever extent it works correctly, you're just getting lucky, because GCC doesn't mean to support this functionality.