There is no way to determine a single host's IP address from the network address and mask. The network address and mask will give you the range of possible host addresses, but not any individual host's IP address.
As you wrote, it is possible to derive the network address from the host address and mask, but it is not possible to do the reverse since you can go from specific to range, but a range has nothing in it to give you a specific.
It's like trying to know which finger is represented by "fingers". You can know that "the left index finger" is is in "fingers on the left hand", but knowing "fingers on the left hand" doesn't give you the specific finger.
