So this code works fine until the second loop, where it should print all the results. There, it prints the same non-null-terminated string with 6 symbols (ABCD@@) all 4 times. Strange it is, because nothing has changed after the first loop, where it printed everything fine.
Then, as you may expect, it crashes of course - at the memory freeing loop, without even freeing the first element...
At line 22, you are setting a[i] to be address of the first character in tmp. However, tmp goes out of scope when the code block ends at line 26, so a[i] is now pointing to invalid memory (and not to the memory you allocated at line 8). Attempting to access the data in that memory in lines 33 and 41 result in undefined behaviour.
EDIT:
nothing has changed after the first loop
What's changed is that tmp has dropped out of scope, and the memory on the stack that it was using, has been reclaimed.