Open SYS_REFCURSOR crash, if many cursors inside a function

DELIMITER //

-- Function that forces cursor array reallocation (17 > default 16 slots)

CREATE OR REPLACE FUNCTION trigger_realloc() RETURNS INT

BEGIN

  DECLARE c1  SYS_REFCURSOR;

  DECLARE c2  SYS_REFCURSOR;

  DECLARE c3  SYS_REFCURSOR;

  DECLARE c4  SYS_REFCURSOR;

  DECLARE c5  SYS_REFCURSOR;

  DECLARE c6  SYS_REFCURSOR;

  DECLARE c7  SYS_REFCURSOR;

  DECLARE c8  SYS_REFCURSOR;

  DECLARE c9  SYS_REFCURSOR;

  DECLARE c10 SYS_REFCURSOR;

  DECLARE c11 SYS_REFCURSOR;

  DECLARE c12 SYS_REFCURSOR;

  DECLARE c13 SYS_REFCURSOR;

  DECLARE c14 SYS_REFCURSOR;

  DECLARE c15 SYS_REFCURSOR;

  DECLARE c16 SYS_REFCURSOR;

  DECLARE c17 SYS_REFCURSOR;

  OPEN c1  FOR SELECT 1;

  OPEN c2  FOR SELECT 1;

  OPEN c3  FOR SELECT 1;

  OPEN c4  FOR SELECT 1;

  OPEN c5  FOR SELECT 1;

  OPEN c6  FOR SELECT 1;

  OPEN c7  FOR SELECT 1;

  OPEN c8  FOR SELECT 1;

  OPEN c9  FOR SELECT 1;

  OPEN c10 FOR SELECT 1;

  OPEN c11 FOR SELECT 1;

  OPEN c12 FOR SELECT 1;

  OPEN c13 FOR SELECT 1;

  OPEN c14 FOR SELECT 1;

  OPEN c15 FOR SELECT 1;

  OPEN c16 FOR SELECT 1;

  OPEN c17 FOR SELECT 1;

  RETURN 1;

END//

CREATE OR REPLACE PROCEDURE trigger_uaf()

BEGIN

  DECLARE c SYS_REFCURSOR;

  OPEN c FOR SELECT trigger_realloc();

END//

DELIMITER ;

SET SESSION max_open_cursors = 100;

CALL trigger_uaf();

-- Server crashes with heap-use-after-free