The problem was that in a timeout event,
thd->lex->restore_backup_query_tables_list() was called when it should
not have been.

Patch tested with the script in MDEV-25651 (not suitable for mtr)