Valgrind is not showing invalid memory access with incorrectly used c_str()

Question

Imagine such code:

string f()
{
  string r = "ab";
  return r;
}

int main() {
    const char *c = f().c_str();
    printf("%s.\n", c);
    return 0;
}

This code may crash, right? Because that string that c points to is destroyed. But running it via Valgrind doesn't show any invalid memory accesses. Why? I know Valgrind cannot check the stack, but "ab" actually is located on the heap, right?