The following test case makes Valgrind complain on the 5.3 tree:

create table t1 (a int);
insert into t1 values (1), (2), (3);
create table t2 as select * from t1;
select * from t1 A, t1 B
where A.a = B.a and A.a in (select a from t2 C) and B.a in (select a from t2 D);
explain
select * from t1 A, t1 B
where A.a = B.a and A.a in (select a from t2 C) and B.a in (select a from t2 D);
drop table t1, t2;

igor@sophia:~/maria/maria-5.3/mysql-test> ./mysql-test-run --valgrind test_1
Logging: ./mysql-test-run --valgrind view_1
MariaDB Version 5.3.0
Turning on valgrind for all executables
Running valgrind with options " --show-reachable=yes --quiet "
vardir: /home/igor/maria/maria-5.3/mysql-test/var
Checking leftover processes...
Removing old var directory...
Creating var directory '/home/igor/maria/maria-5.3/mysql-test/var'...
Installing system database...
Checking supported features...

• skipping ndbcluster
• SSL connections supported
• binaries are debug compiled
  Using "../libtool" when running valgrind, strace or debugger
  Collecting tests...
  Using server port 42383

==============================================================================

TEST RESULT TIME (ms)
------------------------------------------------------------

worker[1] Using MTR_BUILD_THREAD 300, with reserved ports 16000..16019
main.view_1 [ fail ] Found warnings/errors in server log file!
Test ended at 2011-05-23 19:06:07
line
==15939== Thread 4:
==15939== Conditional jump or move depends on uninitialised value(s)
==15939== at 0x769684: best_extension_by_limited_search(JOIN*, unsigned long long, unsigned int, double, double, unsigned int, unsigned int) (sql_select.cc:6064)
==15939== by 0x769976: best_extension_by_limited_search(JOIN*, unsigned long long, unsigned int, double, double, unsigned int, unsigned int) (sql_select.cc:6116)
==15939== by 0x769976: best_extension_by_limited_search(JOIN*, unsigned long long, unsigned int, double, double, unsigned int, unsigned int) (sql_select.cc:6116)
==15939== by 0x768E10: greedy_search(JOIN*, unsigned long long, unsigned int, unsigned int) (sql_select.cc:5771)
==15939== by 0x76864F: choose_plan(JOIN*, unsigned long long) (sql_select.cc:5433)
==15939== by 0x762ECC: make_join_statistics(JOIN*, TABLE_LIST*, Item*, st_dynamic_array*) (sql_select.cc:3353)
==15939== by 0x75AA0B: JOIN::optimize() (sql_select.cc:1016)
==15939== by 0x76106F: mysql_select(THD*, Item**, TABLE_LIST, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:2768)
==15939== by 0x758644: handle_select(THD*, st_lex*, select_result*, unsigned long) (sql_select.cc:281)
==15939== by 0x6E88E6: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:5097)
==15939== by 0x6DF9F5: mysql_execute_command(THD*) (sql_parse.cc:2242)
==15939== by 0x6EB227: mysql_parse(THD*, char*, unsigned int, char const**) (sql_parse.cc:6097)
==15939== by 0x6DD301: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1218)
==15939== by 0x6DC65D: do_command(THD*) (sql_parse.cc:904)
==15939== by 0x6D91A5: handle_one_connection (sql_connect.cc:1177)
==15939== by 0x58B6A4E: start_thread (in /lib64/libpthread-2.11.2.so)
...