diff --git a/src/cmd/ksh93/sh/xec.c b/src/cmd/ksh93/sh/xec.c
index 55ebaf39f471..308cfc97e7bb 100644
--- a/src/cmd/ksh93/sh/xec.c
+++ b/src/cmd/ksh93/sh/xec.c
@@ -1154,7 +1154,7 @@ int sh_exec(register const Shnode_t *t, int flags)
 			if((io||argn))
 			{
 				Shbltin_t *bp=0;
-				static char *argv[1];
+				static char *argv[2];
 				int tflags = 1;
 				if(np &&  nv_isattr(np,BLT_DCL))
 					tflags |= 2;
diff --git a/src/cmd/ksh93/tests/io.sh b/src/cmd/ksh93/tests/io.sh
index 175de0ed3ce2..037ace820f0a 100755
--- a/src/cmd/ksh93/tests/io.sh
+++ b/src/cmd/ksh93/tests/io.sh
@@ -633,5 +633,21 @@ err=$(
 ) || err_exit 'Process substitution leaks file descriptors when used as argument to function' \
 	"(got $(printf %q "$err"))"
 
+# ======
+# A redirection with a null command could crash under certain circumstances (rhbz#1200534)
+"$SHELL" -i >/dev/null -c '
+	function dlog
+	{
+		fc -ln -0
+	}
+	trap dlog DEBUG
+	for((i=0;i<1000;i++))
+	do	>"$1/rhbz1200534"
+	done
+	exit
+' empty_redir_crash_test "$tmp"
+((!(e = $?))) || err_exit 'crash on null-command redirection with DEBUG trap' \
+	"(got status $e$( ((e>128)) && print -n / && kill -l "$e"), $(printf %q "$got"))"
+
 # ======
 exit $((Errors<125?Errors:125))