This was only demonstrated by the use of PASSWORD(), it was not related to
  that function at all. The calculation of the size of a field in the results
  of a UNION did not take into account the possible growth of a string field
  when being converted to the aggregated character set.


mysql-test/r/union.result:
  Add new results
mysql-test/t/union.test:
  Add new regression test
sql/item.cc:
  Fix calculation of max_length when figuring out the type of a column in
  a UNION. It needs to take into account any expansion of field size due to
  charset conversions.