Crash when using BETWEEN AND

[suyZhong]

Describe the bug
Consider the test cases below. It would crash the monetdb server. The last lines of the server log (merovingian.log):

2024-02-22 06:50:09 ERR monetdb[1347]: #client9727: exp_bin: CRITICAL: Could not find %3.%3
2024-02-22 06:50:09 ERR monetdb[1347]: #client9727: exp_bin: ERROR: Query: 'select t0.c1, t0.c0 from t0 where (((t0.c1 between -1 and 1))or((t0.c1 between -1 and ('b' in (t0.c1, t0.c0)))));'
2024-02-22 06:50:09 ERR monetdb[1347]: mserver5: /app/MonetDB/sql/backends/monet5/rel_bin.c:1681: exp_bin: Assertion `s' failed.
2024-02-22 06:50:12 MSG merovingian[159]: database 'monetdb' (1347) has crashed with signal SIGABRT (dumped core)

To Reproduce

To reproduce, execute the mclient using docker exec -i monetdb-test mclient -E UTF-8 -d monetdb and copy the following queries:

DROP TABLE t0 CASCADE;
CREATE TABLE t0(c0 VARCHAR(500), c1 VARCHAR(500));
INSERT INTO t0(c1) VALUES ('a');

SELECT t0.c1, t0.c0 FROM t0 WHERE (((t0.c1 BETWEEN -1 AND 1))OR((t0.c1 BETWEEN -1 AND ('b' IN (t0.c1, t0.c0)))));

Expected behavior
Should return an error message, or return the correct result.

Screenshots
N/A

Software versions
Build from source:

> docker exec monetdb-test mserver5 --version --dbname=monetdb
MonetDB 5 server 11.50.0 (hg id: 5f31415) (64-bit, 128-bit integers)
This is an unreleased version
Copyright (c) 1993 - July 2008 CWI
Copyright (c) August 2008 - 2023 MonetDB B.V., all rights reserved
Visit https://www.monetdb.org/ for further information
Found 503.5GiB available memory, 128 available cpu cores
Libraries:
Compiled by: @97de17abeb72 (x86_64-pc-linux-gnu)
Compilation: /usr/bin/cc 
Linking    : /usr/bin/ld

Issue labeling
Bug

Additional context
Kindly inform me if you need more information (e.g. error trace, etc.)

[mvdvm]

Also produces assertion failure in Dec2023 release.
Without the assertion it fails to produce a valid result set (0 columns instead of 2 expected).

[njnes]

the merge range expressions optimizer 'reused' expressions. Those got later optimized, leading to some complex form of dangling pointers. We now properly create copies of those expresssions. Fixed on Dec2023 branch.