Analysis:
The cause for the failing assert was that between preparation
and execution of a DELETE prepared statement, the server reverted
back all changes of the item tree. Since the substitution of
Item_in_subselect by an Item_in_optimizer was recorded via
change_item_tree, thus the rollback of the item tree affected
the substitution as well. As a result the execution of the PS
called Item_in_subselect::val_int(), which was never supposed
to be called.

Solution:
Replace change_item_tree with assignment. This is OK because
the Item objects used for substitution are created in PS memory.