This simple test case crashes the server:

--source include/master-slave.inc

--connection server_2

kill hard query user test2@nohost;

--source include/rpl_end.inc

It crashes inside kill_threads_for_user(), in this code:

    if (((user->host.str[0] == '%' && !user->host.str[1]) ||

         !strcmp(tmp->security_ctx->host, user->host.str)) &&

        !strcmp(tmp->security_ctx->user, user->user.str))

tmp->security_ctx->host is NULL for the slave IO thread, so we get a NULL
pointer reference inside strcmp().

I'm not sure if the bug here is that the host field is NULL in the replication
thread, or if the bug is that the code in kill_threads_for_user() should check
for NULL...