create table select with binlog_format MIXED/STATEMENT crashes node

The following sequence of commands causes segmentation fault:

create table t1 (a int primary key);
set binlog_format=STATEMENT;
create table t2 select * from t1;

Backtrace:

#0 __pthread_kill (threadid=<optimized out>, signo=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/pthread_kill.c:63
#1 0x00000000006a2359 in handle_fatal_signal (sig=11)
    at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/signal_handler.cc:247
#2 <signal handler called>
#3 my_b_safe_tell (info=0x106e558) at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/mysys/mf_iocache2.c:122
#4 0x00000000007466d8 in Log_event::write_header (this=0x7f5aac03e750, file=0x106e558, event_data_length=<optimized out>)
    at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/log_event.cc:1006
#5 0x00000000007474aa in Query_log_event::write (this=0x7f5aac03e750, file=0x106e558)
    at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/log_event.cc:2464
#6 0x0000000000739b74 in MYSQL_BIN_LOG::write (this=<optimized out>, event_info=<optimized out>)
    at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/log.cc:5235
#7 0x000000000056f08d in THD::binlog_query (this=0x32ae1b0, qtype=THD::ROW_QUERY_TYPE,
    query_arg=0x7f5a64004e90 "create table t2 select * from t1", query_len=32, is_trans=<optimized out>,
    direct=<optimized out>, suppress_use=false, errcode=0)
    at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/sql_class.cc:5410
#8 0x000000000057acd5 in select_insert::send_eof (this=0x7f5a64005ce0)
    at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/sql_insert.cc:3532
#9 0x000000000057af2f in select_create::send_eof (this=0x7f5a64005ce0)
    at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/sql_insert.cc:4049
#10 0x00000000005c84b8 in do_select (join=0x7f5a6400ca30, fields=<optimized out>, table=0x0, procedure=0x0)
    at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/sql_select.cc:11575
#11 0x00000000005d5d3d in JOIN::exec (this=0x7f5a6400ca30)
    at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/sql_select.cc:2385
#12 0x00000000005d7825 in mysql_select (thd=0x32ae1b0, rref_pointer_array=<optimized out>, tables=<optimized out>,
    wild_num=<optimized out>, fields=..., conds=<optimized out>, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0,
    select_options=2416184064, result=0x7f5a64005ce0, unit=0x32afd18, select_lex=0x32b0338)
    at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/sql_select.cc:2604
#13 0x00000000005d8295 in handle_select (thd=0x32ae1b0, lex=0x32afc68, result=0x7f5a64005ce0, setup_tables_done_option=0)
    at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/sql_select.cc:297
#14 0x000000000059990e in mysql_execute_command (thd=0x32ae1b0)
    at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/sql_parse.cc:2830
#15 0x0000000000599aa4 in mysql_parse (thd=0x32ae1b0, parser_state=0x7f5aac041210, length=<optimized out>,
    rawbuf=<optimized out>) at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/sql_parse.cc:6203
#16 0x000000000059a3ab in mysql_parse (parser_state=0x7f5aac041210, length=32,
    rawbuf=0x7f5a64004e90 "create table t2 select * from t1", thd=0x32ae1b0)
    at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/sql_parse.cc:6154
#17 wsrep_mysql_parse (thd=0x32ae1b0, rawbuf=0x7f5a64004e90 "create table t2 select * from t1", length=32,
    parser_state=0x7f5aac041210) at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/sql_parse.cc:6036
#18 0x000000000059bff7 in dispatch_command (command=COM_QUERY, thd=0x32ae1b0, packet=<optimized out>,
    packet_length=2885948152) at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/sql_parse.cc:1212
#19 0x000000000059c60d in do_command (thd=0x32ae1b0)
    at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/sql_parse.cc:869
#20 0x000000000063eb95 in do_handle_one_connection (thd_arg=<optimized out>)
    at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/sql_connect.cc:878
#21 0x000000000063edac in handle_one_connection (arg=0x32ae1b0)
    at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/sql_connect.cc:790
#22 0x00007f5ab0596e9a in start_thread (arg=0x7f5aac042700) at pthread_create.c:308
#23 0x00007f5ab02c3cbd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#24 0x0000000000000000 in ?? ()
(gdb) f 4
#4 0x00000000007466d8 in Log_event::write_header (this=0x7f5aac03e750, file=0x106e558, event_data_length=<optimized out>)
    at /home/teemu/codership/galera/bzr/codership-mysql/5.5-23/sql/log_event.cc:1006
1006 log_pos= my_b_safe_tell(file)+data_written;
(gdb) p *file
$1 = {pos_in_file = 0, end_of_file = 0, read_pos = 0x0, read_end = 0x0, buffer = 0x0, request_pos = 0x0, write_buffer = 0x0,
  append_read_pos = 0x0, write_pos = 0x0, write_end = 0x0, current_pos = 0x0, current_end = 0x0, append_buffer_lock = {
    m_mutex = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __list = {__prev = 0x0,
          __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, m_psi = 0x0}, share = 0x0, read_function = 0,
  write_function = 0, type = TYPE_NOT_SET, pre_read = 0, post_read = 0, pre_close = 0, disk_writes = 0, arg = 0x0,
  file_name = 0x0, dir = 0x0, prefix = 0x0, file = 0, seek_not_done = 0, error = 0, buffer_length = 0, read_length = 0,
  myflags = 0, alloced_buffer = 0 '\000'}

IO cache stays empty which causes null pointer dereference in my_b_safe_tell().