Post push fix:
setup_ref_array() now uses n_sum_items to determine size of ref_pointer_array.
The problem was that n_sum_items kept growing, it wasn't reset for each query.

A similar memory leak was fixed with the patch for:
Bug 14683676 ENDLESS MEMORY CONSUMPTION IN SETUP_REF_ARRAY WITH MAX IN SUBQUERY


sql/sql_yacc.yy:
  Reset parsing_place when we're done parsing SHOW commands, 
  to prevent Item::Item incrementing select_n_having_items
  (which is also used in setup_ref_array())