on disconnect THD must clean user_var_events array before dropping temporary tables. Otherwise when binlogging a DROP, it'll access user_var_events, but they were allocated in the already freed memroot.