Legal member access violation with polymorphism

access.cpp

#include <iostream>

class Base
{
public:
    virtual void action() { std::cout << "Base::action()\n"; }
};

class Derived : public Base
{
private:
    void action() override { std::cout << "Derived::action()\n"; }
};

int main(void)
{
    Derived derived;
    Base& base = derived;

    // derived.action(); // does not build!
    base.action(); // call the private method!

    return 0;
}