What address would me contain otherwise? Here you gave it the address of tmp -- but if you replace it with int** me = &aa.get_dummy();, where would it point?
There's no meaningful answer to that question, so the standard requires that the argument of & be an lvalue.