C++ rvalue reference behaviour (specific example)

I'm currently trying to get libc++ to compile and run with MSVC. In doing so I encountered a nasty bug (at least what I think is a bug) which has taken me a while to pin down. I have the following repro code:

int globalInt = 666;

class mini_move_iterator
{
public:

    mini_move_iterator(int* i) : __i(i){}

    int&& operator*() const
    {
        return static_cast<int&&>(*__i);
    }

    int* __i;
};

void foo(int&& rval)
{
    // Smash stack
    char stackUser[1000];
    for (int i = 0; i < 1000; ++i)
        stackUser[i] = 0xff;

    rval += 1;
}

int main()
{
    mini_move_iterator mmi(&globalInt);
    foo(*mmi);
    return 0;
}

I have a few questions:

1) Is this legal, i.e. have I avoided straying into the realms of undefined behaviour (it is certainly syntactically legal)?

2) What is the expected value of the global variable globalInt after foo returns (undefined may be an acceptable answer)?

EDIT:

I should have made clear that this isn't working in VS with MSVC 12. In foo the variable rval is pointing to a temporary on the stack. If I replace:

return static_cast<int&&>(*__i);

with

return std::move(*i);

then all is well. Using a C-cast also causes the temporary to be created.