UPD: next( &c ) is a valid address for dereference. There will be a data character or a null-terminator.
basic_string is implemented as: [ size_t __cap_ ][ size_t __size_ ][ char* __data_ (ends with \0) ]

UPD: After some research and tests, I've noticed, that Clang 8 implements strings with a null-terminator in the memory layout. Technically, I dereference not std::string::end (which would be UB), but the address in memory, where \0 is located.

Trying to access the next character with &c might give you a bad memory address because it's getting the address of the reference variable c and not necessarily the next character in the string.

right?

You are right. I probably thought that one of the variables could have been 0, but the description mentions that the given numbers are in the range from 1 to 10.

a + b * c <= a * c + b * c

a * b + c <= a * b + a * c

Its great math but a bad 8 kyu question. In my opinion 8 kyu questions should be aimed to 10 year old kids with a Programming book at hand.

This gives the line "she made a mistake" a whole other meaning. Good Job.

Use spoiler flag, please.