Original test case was too big to add it.
Unfortunately I didn't manage to reduce it.


sql/sql_select.cc:
  a fix (Bug #4237: Server crash with a subquery SELECT).