diff --git a/docs/rh-log.txt b/docs/rh-log.txt
index f14ae98541..6797680f44 100644
--- a/docs/rh-log.txt
+++ b/docs/rh-log.txt
@@ -1,3 +1,8 @@
+October 28, 2008  (Changes by Graf Zahl)
+- Fixed: FStateExpressions could copy unresolved default parameter expressions.
+  When these were resolved and changed later all copied pointers pointed to
+  invalid data.
+
 October 26, 2008  (Changes by Graf Zahl)
 - Added read and write barriers to the actor pointer in the sound channel
   structure.
diff --git a/src/thingdef/thingdef_expression.cpp b/src/thingdef/thingdef_expression.cpp
index 44e10cba94..e199faa5a3 100644
--- a/src/thingdef/thingdef_expression.cpp
+++ b/src/thingdef/thingdef_expression.cpp
@@ -2763,7 +2763,8 @@ void FStateExpressions::Copy(int dest, int src, int cnt)
 {
 	for(int i=0; i<cnt; i++)
 	{
-		expressions[dest+i].expr = expressions[src+i].expr;
+		// For now set only a reference because these expressions may change when being resolved
+		expressions[dest+i].expr = (FxExpression*)(src+i);
 		expressions[dest+i].cloned = true;
 	}
 }
@@ -2782,7 +2783,13 @@ int FStateExpressions::ResolveAll()
 	ctx.lax = true;
 	for(unsigned i=0; i<Size(); i++)
 	{
-		if (expressions[i].expr != NULL && !expressions[i].cloned)
+		if (expressions[i].cloned)
+		{
+			// Now that everything coming before has been resolved we may copy the actual pointer.
+			intptr_t ii = ((intptr_t)expressions[i].expr)-1;
+			expressions[i].expr = expressions[ii].expr;
+		}
+		else if (expressions[i].expr != NULL)
 		{
 			ctx.cls = expressions[i].owner;
 			ctx.isconst = expressions[i].constant;