Slave crashes in show_status_array upon running a trigger with select from I_S

--source include/master-slave.inc

--source include/have_binlog_format_mixed.inc

CREATE TABLE t1 (f1 INT);

CREATE TABLE t2 (f2 VARCHAR(64));

CREATE TRIGGER tr BEFORE INSERT ON t1 FOR EACH ROW INSERT INTO t2 SELECT variable_name FROM INFORMATION_SCHEMA.SESSION_VARIABLES;

INSERT INTO t1 VALUES (1);

# Cleanup

DROP TABLE t1, t2;

--source include/rpl_end.inc

#3  <signal handler called>

#4  0x0000000000ceab5c in strend (s=0xa5a5a5a5a5a5a5a6 <error: Cannot access memory at address 0xa5a5a5a5a5a5a5a6>) at /data/src/5.5/strings/strend.c:45

#5  0x0000000000679984 in show_status_array (thd=0x7fa61e016060, wild=0x0, variables=0x7fa61e0e2350, value_type=OPT_SESSION, status_var=0x0, prefix=0xd22563 "", table=0x7fa61e0cc078, ucase_names=true, cond=0x0) at /data/src/5.5/sql/sql_show.cc:2723

#6  0x0000000000689152 in fill_variables (thd=0x7fa61e016060, tables=0x7fa61e070648, cond=0x0) at /data/src/5.5/sql/sql_show.cc:6971

#7  0x000000000068b857 in get_schema_tables_result (join=0x7fa61e0c9510, executed_place=PROCESSED_BY_JOIN_EXEC) at /data/src/5.5/sql/sql_show.cc:7799

#8  0x0000000000634817 in JOIN::exec (this=0x7fa61e0c9510) at /data/src/5.5/sql/sql_select.cc:2366

#9  0x0000000000637064 in mysql_select (thd=0x7fa61e016060, rref_pointer_array=0x7fa61e06d4b8, tables=0x7fa61e070648, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=4027583232, result=0x7fa61e0c9478, unit=0x7fa61e06cb38, select_lex=0x7fa61e06d218) at /data/src/5.5/sql/sql_select.cc:3103

#10 0x000000000062d86c in handle_select (thd=0x7fa61e016060, lex=0x7fa61e06ca88, result=0x7fa61e0c9478, setup_tables_done_option=1073741824) at /data/src/5.5/sql/sql_select.cc:319

#11 0x000000000060200d in mysql_execute_command (thd=0x7fa61e016060) at /data/src/5.5/sql/sql_parse.cc:3051

#12 0x00000000008e05b0 in sp_instr_stmt::exec_core (this=0x7fa61e070c18, thd=0x7fa61e016060, nextp=0x7fa62e7bb6e8) at /data/src/5.5/sql/sp_head.cc:3220

#13 0x00000000008dfd57 in sp_lex_keeper::reset_lex_and_exec_core (this=0x7fa61e070c58, thd=0x7fa61e016060, nextp=0x7fa62e7bb6e8, open_tables=false, instr=0x7fa61e070c18) at /data/src/5.5/sql/sp_head.cc:2998

#14 0x00000000008e02d8 in sp_instr_stmt::execute (this=0x7fa61e070c18, thd=0x7fa61e016060, nextp=0x7fa62e7bb6e8) at /data/src/5.5/sql/sp_head.cc:3144

#15 0x00000000008dc141 in sp_head::execute (this=0x7fa61e06c078, thd=0x7fa61e016060, merge_da_on_success=false) at /data/src/5.5/sql/sp_head.cc:1431

#16 0x00000000008dcc1f in sp_head::execute_trigger (this=0x7fa61e06c078, thd=0x7fa61e016060, db_name=0x7fa61e01bda8, table_name=0x7fa61e01bdb8, grant_info=0x7fa61e0a8528) at /data/src/5.5/sql/sp_head.cc:1736

#17 0x00000000006ac374 in Table_triggers_list::process_triggers (this=0x7fa61e0a8478, thd=0x7fa61e016060, event=TRG_EVENT_INSERT, time_type=TRG_ACTION_BEFORE, old_row_is_record1=true) at /data/src/5.5/sql/sql_trigger.cc:2156

#18 0x00000000005af599 in fill_record_n_invoke_before_triggers (thd=0x7fa61e016060, ptr=0x7fa61e01b188, values=..., ignore_errors=false, triggers=0x7fa61e0a8478, event=TRG_EVENT_INSERT) at /data/src/5.5/sql/sql_base.cc:9234

#19 0x00000000005e3509 in mysql_insert (thd=0x7fa61e016060, table_list=0x7fa61e0620e0, fields=..., values_list=..., update_fields=..., update_values=..., duplic=DUP_ERROR, ignore=false) at /data/src/5.5/sql/sql_insert.cc:952

#20 0x0000000000601bb4 in mysql_execute_command (thd=0x7fa61e016060) at /data/src/5.5/sql/sql_parse.cc:2965

#21 0x00000000006098ce in mysql_parse (thd=0x7fa61e016060, rawbuf=0x7fa61e059470 "INSERT INTO t1 VALUES (1)", length=25, parser_state=0x7fa62e7bc5e0) at /data/src/5.5/sql/sql_parse.cc:5923

#22 0x000000000088dcf1 in Query_log_event::do_apply_event (this=0x7fa61e073220, rli=0x7fa626f74850, query_arg=0x7fa61e059470 "INSERT INTO t1 VALUES (1)", q_len_arg=25) at /data/src/5.5/sql/log_event.cc:3812

#23 0x000000000088d23d in Query_log_event::do_apply_event (this=0x7fa61e073220, rli=0x7fa626f74850) at /data/src/5.5/sql/log_event.cc:3551

#24 0x000000000057e9c8 in Log_event::apply_event (this=0x7fa61e073220, rli=0x7fa626f74850) at /data/src/5.5/sql/log_event.h:1256

#25 0x000000000057695d in apply_event_and_update_pos (ev=0x7fa61e073220, thd=0x7fa61e016060, rli=0x7fa626f74850) at /data/src/5.5/sql/slave.cc:2658

#26 0x0000000000576f02 in exec_relay_log_event (thd=0x7fa61e016060, rli=0x7fa626f74850) at /data/src/5.5/sql/slave.cc:2818

#27 0x0000000000579337 in handle_slave_sql (arg=0x7fa626f73060) at /data/src/5.5/sql/slave.cc:3675

#28 0x0000000000a0d6d9 in pfs_spawn_thread (arg=0x7fa61d4c6260) at /data/src/5.5/storage/perfschema/pfs.cc:1015

#29 0x00007fa62e4d4494 in start_thread (arg=0x7fa62e7bd700) at pthread_create.c:333

#30 0x00007fa62ceea93f in clone () from /lib/x86_64-linux-gnu/libc.so.6