Question related to std::string object and c_str() method in 3 different implementations

I saw a strange behavior the other day. So I wanted to store lines(present in a vector) in a char array and wanted to use '\n' as delimiter.

I know c_str() method in string class returns a pointer to a char array ending in '\0'.

Based on my experience/understanding of C++.(see greet0 and greet2 functions). I assumed it should work but it didn't.

Can anyone explain the different behavior in three greet functions? What is the the scope of the object mentioned in each of the greet function? (also i had a guess that the string object was destroyed in greet1 function but if that would have been the case there should be segmentation fault in cout<<"greet1:"<<w1<<endl; but that does not happen so what exactly is happening in background).

# The snippet that where i first encountered the issue. 
const char* concatinated_str(std::vector<std::string> lines, const char *delimiter)
{
        std::stringstream buf;
        std::copy(lines.begin(), lines.end(), std::ostream_iterator<std::string>(buf, delimiter));
        string w = buf.str();
        const char *ret = w.c_str();

        return ret;

}

#Implementation 0
string greet0(){
    string msg = "hello";
    return msg;
}

#Implementation 1
const char* greet1(){
    string msg = "hello";
    cout<<&msg<<endl;
    return msg.c_str();
}

#Implementation 2
const char* greet2(){
    const char* msg = "hello";
    return msg;
}


int main(){
    auto w0 = greet0();
    cout<<&w0<<endl;
    cout<<"greet0:"<<w0<<endl;

    auto w1 = greet1();
    cout<<"greet1:"<<w1<<endl;
    
    const char* w2 = greet2();
    cout<<"greet2:"<<w2<<endl;
}

# Output:
0x7fff0ff3e8e0
0x7fff0ff3e8e0
greet0:hello
greet1:
greet2:hello