Index: src/parse.y
==================================================================
--- src/parse.y
+++ src/parse.y
@@ -1132,22 +1132,14 @@
     A.pExpr = sqlite3PExpr(pParse, TK_IN, A.pExpr, 0, 0);
     sqlite3PExprAddSelect(pParse, A.pExpr, Y);
     exprNot(pParse, N, &A);
     A.zEnd = &E.z[E.n];
   }
-  expr(A) ::= expr(A) in_op(N) nm(Y) dbnm(Z). [IN] {
+  expr(A) ::= expr(A) in_op(N) nm(Y) dbnm(Z) paren_exprlist(E). [IN] {
     SrcList *pSrc = sqlite3SrcListAppend(pParse->db, 0,&Y,&Z);
     Select *pSelect = sqlite3SelectNew(pParse, 0,pSrc,0,0,0,0,0,0,0);
-    A.pExpr = sqlite3PExpr(pParse, TK_IN, A.pExpr, 0, 0);
-    sqlite3PExprAddSelect(pParse, A.pExpr, pSelect);
-    exprNot(pParse, N, &A);
-    A.zEnd = Z.z ? &Z.z[Z.n] : &Y.z[Y.n];
-  }
-  expr(A) ::= expr(A) in_op(N) nm(Y) dbnm(Z) LP exprlist(E) RP. [IN] {
-    SrcList *pSrc = sqlite3SrcListAppend(pParse->db, 0,&Y,&Z);
-    Select *pSelect = sqlite3SelectNew(pParse, 0,pSrc,0,0,0,0,0,0,0);
-    sqlite3SrcListFuncArgs(pParse, pSrc, E);
+    if( E )  sqlite3SrcListFuncArgs(pParse, pSelect ? pSrc : 0, E);
     A.pExpr = sqlite3PExpr(pParse, TK_IN, A.pExpr, 0, 0);
     sqlite3PExprAddSelect(pParse, A.pExpr, pSelect);
     exprNot(pParse, N, &A);
     A.zEnd = Z.z ? &Z.z[Z.n] : &Y.z[Y.n];
   }
@@ -1199,10 +1191,18 @@
 exprlist(A) ::= .                            {A = 0;}
 nexprlist(A) ::= nexprlist(A) COMMA expr(Y).
     {A = sqlite3ExprListAppend(pParse,A,Y.pExpr);}
 nexprlist(A) ::= expr(Y).
     {A = sqlite3ExprListAppend(pParse,0,Y.pExpr); /*A-overwrites-Y*/}
+
+/* A paren_exprlist is an optional expression list contained inside
+** of parenthesis */
+%type paren_exprlist {ExprList*}
+%destructor paren_exprlist {sqlite3ExprListDelete(pParse->db, $$);}
+paren_exprlist(A) ::= .   {A = 0;}
+paren_exprlist(A) ::= LP exprlist(X) RP.  {A = X;}
+
 
 
 ///////////////////////////// The CREATE INDEX command ///////////////////////
 //
 cmd ::= createkw(S) uniqueflag(U) INDEX ifnotexists(NE) nm(X) dbnm(D)

Index: src/whereexpr.c
==================================================================
--- src/whereexpr.c
+++ src/whereexpr.c
@@ -783,16 +783,14 @@
     return 0;
   }
   pColl = sqlite3BinaryCompareCollSeq(pParse, pExpr->pLeft, pExpr->pRight);
   if( pColl==0 || sqlite3StrICmp(pColl->zName, "BINARY")==0 ) return 1;
   pColl = sqlite3ExprCollSeq(pParse, pExpr->pLeft);
-  /* Since pLeft and pRight are both a column references, their collating
-  ** sequence should always be defined. */
-  zColl1 = ALWAYS(pColl) ? pColl->zName : 0;
+  zColl1 = pColl ? pColl->zName : 0;
   pColl = sqlite3ExprCollSeq(pParse, pExpr->pRight);
-  zColl2 = ALWAYS(pColl) ? pColl->zName : 0;
-  return sqlite3StrICmp(zColl1, zColl2)==0;
+  zColl2 = pColl ? pColl->zName : 0;
+  return sqlite3_stricmp(zColl1, zColl2)==0;
 }
 
 /*
 ** Recursively walk the expressions of a SELECT statement and generate
 ** a bitmask indicating which tables are used in that expression

ADDED   test/collateB.test
Index: test/collateB.test
==================================================================
--- /dev/null
+++ test/collateB.test
@@ -0,0 +1,63 @@
+# 2016-07-01
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+# Test cases for a crash bug.
+#
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+
+do_execsql_test collateB-1.1 {
+  CREATE TABLE t1(a INTEGER PRIMARY KEY);
+  CREATE TABLE t2(b INTEGER PRIMARY KEY, x1 INT COLLATE NOCASE);
+  CREATE TABLE t3(x2 INT);
+  SELECT * FROM t3, t2, t1 WHERE x2=b AND x1=a AND a=1;
+} {}
+do_execsql_test collateB-1.2 {
+  INSERT INTO t1(a) VALUES(1),(2),(3);
+  INSERT INTO t2(b,x1) VALUES(11,1),(22,2),(33,3);
+  INSERT INTO t3(x2) VALUES(11),(22),(33);
+  SELECT *,'|' FROM t3, t2, t1 WHERE x2=b AND x1=a AND a=1;
+} {11 11 1 1 |}
+do_execsql_test collateB-1.3 {
+  SELECT *,'|' FROM t3, t1, t2 WHERE x2=b AND x1=a AND a=1;
+} {11 1 11 1 |}
+do_execsql_test collateB-1.4 {
+  SELECT *,'|' FROM t2, t3, t1 WHERE x2=b AND x1=a AND a=1;
+} {11 1 11 1 |}
+do_execsql_test collateB-1.5 {
+  SELECT *,'|' FROM t2, t1, t3 WHERE x2=b AND x1=a AND a=1;
+} {11 1 1 11 |}
+do_execsql_test collateB-1.6 {
+  SELECT *,'|' FROM t1, t2, t3 WHERE x2=b AND x1=a AND a=1;
+} {1 11 1 11 |}
+do_execsql_test collateB-1.7 {
+  SELECT *,'|' FROM t1, t2, t3 WHERE x2=b AND x1=a AND a=1;
+} {1 11 1 11 |}
+do_execsql_test collateB-1.12 {
+  SELECT *,'|' FROM t3, t2, t1 WHERE b=x2 AND a=x1 AND 1=a;
+} {11 11 1 1 |}
+do_execsql_test collateB-1.13 {
+  SELECT *,'|' FROM t3, t1, t2 WHERE b=x2 AND a=x1 AND 1=a;
+} {11 1 11 1 |}
+do_execsql_test collateB-1.14 {
+  SELECT *,'|' FROM t2, t3, t1 WHERE b=x2 AND a=x1 AND 1=a;
+} {11 1 11 1 |}
+do_execsql_test collateB-1.15 {
+  SELECT *,'|' FROM t2, t1, t3 WHERE b=x2 AND a=x1 AND 1=a;
+} {11 1 1 11 |}
+do_execsql_test collateB-1.16 {
+  SELECT *,'|' FROM t1, t2, t3 WHERE b=x2 AND a=x1 AND 1=a;
+} {1 11 1 11 |}
+do_execsql_test collateB-1.17 {
+  SELECT *,'|' FROM t1, t2, t3 WHERE b=x2 AND a=x1 AND 1=a;
+} {1 11 1 11 |}
+
+finish_test

Index: test/tabfunc01.test
==================================================================
--- test/tabfunc01.test
+++ test/tabfunc01.test
@@ -133,10 +133,19 @@
 #
 do_execsql_test tabfunc01-500 {
   SELECT * FROM generate_series WHERE start IN (1,7) AND stop=20 AND step=10
   ORDER BY +1;
 } {1 7 11 17}
+
+# Table-valued functions on the RHS of an IN operator
+#
+do_execsql_test tabfunc01-600 {
+  CREATE TABLE t600(a INTEGER PRIMARY KEY, b TEXT);
+  WITH RECURSIVE c(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM c WHERE x<100)
+    INSERT INTO t600(a,b) SELECT x, printf('(%03d)',x) FROM c;
+  SELECT b FROM t600 WHERE a IN generate_series(2,52,10);
+} {(002) (012) (022) (032) (042) (052)}
 
 
 do_test tabfunc01-600 {
   set TAIL {}
   set VM [sqlite3_prepare db {SELECT * FROM intarray(?2,?3)} -1 TAIL]