ABORT THROWN BY INTERNAL EXCEPTION: Positional reference expression could not be bound

[fuzzerofducks]

Issue found by DuckFuzz on git commit hash 4ff54 using seed 943804428.

To Reproduce

create table all_types as select * exclude(small_enum, medium_enum, large_enum) from test_all_types() limit 0;
SELECT (7226 BETWEEN 9220 AND md5_number_upper(#4))

Error Message

ABORT THROWN BY INTERNAL EXCEPTION: Positional reference expression could not be bound

Stack Trace

duckdb::StackTrace::GetStackTrace[abi:cxx11](unsigned long) 
duckdb::InternalException::InternalException(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) 
duckdb::ExpressionBinder::BindPositionalReference(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, unsigned long, bool) 
duckdb::ExpressionBinder::BindExpression(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, unsigned long, bool) 
duckdb::MacroFunction::BindMacroFunction(duckdb::Binder&, duckdb::vector<duckdb::unique_ptr<duckdb::MacroFunction, std::default_delete<duckdb::MacroFunction>, true>, true, std::allocator<duckdb::unique_ptr<duckdb::MacroFunction, std::default_delete<duckdb::MacroFunction>, true> > > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, duckdb::FunctionExpression&, duckdb::vector<duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>, true, std::allocator<duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true> > >&, duckdb::InsertionOrderPreservingMap<duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true> >&, unsigned long) 
duckdb::ExpressionBinder::UnfoldMacroExpression(duckdb::FunctionExpression&, duckdb::ScalarMacroCatalogEntry&, duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, unsigned long) 
duckdb::ExpressionBinder::BindMacro(duckdb::FunctionExpression&, duckdb::ScalarMacroCatalogEntry&, unsigned long, duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&) 
duckdb::ExpressionBinder::BindExpression(duckdb::FunctionExpression&, unsigned long, duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&) 
duckdb::ExpressionBinder::BindExpression(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, unsigned long, bool) 
duckdb::BaseSelectBinder::BindExpression(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, unsigned long, bool) 
duckdb::ExpressionBinder::Bind(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, unsigned long, bool) 
duckdb::ExpressionBinder::BindChild(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, unsigned long, duckdb::ErrorData&) 
duckdb::ExpressionBinder::BindExpression(duckdb::BetweenExpression&, unsigned long) 
duckdb::ExpressionBinder::BindExpression(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, unsigned long, bool) 
duckdb::BaseSelectBinder::BindExpression(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, unsigned long, bool) 
duckdb::ExpressionBinder::Bind(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, unsigned long, bool) 
duckdb::ExpressionBinder::Bind(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, duckdb::optional_ptr<duckdb::LogicalType, true>, bool) 
duckdb::Binder::BindSelectNode(duckdb::SelectNode&, duckdb::BoundStatement) 
duckdb::Binder::BindNode(duckdb::SelectNode&) 
duckdb::Binder::BindNode(duckdb::QueryNode&) 
duckdb::Binder::Bind(duckdb::QueryNode&) 
duckdb::Binder::Bind(duckdb::SelectStatement&) 
duckdb::Binder::Bind(duckdb::SQLStatement&) 
duckdb::Planner::CreatePlan(duckdb::SQLStatement&) 
duckdb::Planner::CreatePlan(duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>) 
duckdb::ClientContext::CreatePreparedStatementInternal(duckdb::ClientContextLock&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, duckdb::optional_ptr<std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, duckdb::BoundParameterData, duckdb::CaseInsensitiveStringHashFunction, duckdb::CaseInsensitiveStringEquality, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, duckdb::BoundParameterData> > >, true>) 
duckdb::ClientContext::CreatePreparedStatement(duckdb::ClientContextLock&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, duckdb::optional_ptr<std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, duckdb::BoundParameterData, duckdb::CaseInsensitiveStringHashFunction, duckdb::CaseInsensitiveStringEquality, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, duckdb::BoundParameterData> > >, true>, duckdb::PreparedStatementMode) 
duckdb::ClientContext::PendingStatementInternal(duckdb::ClientContextLock&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, duckdb::PendingQueryParameters const&) 
duckdb::ClientContext::PendingStatementOrPreparedStatement(duckdb::ClientContextLock&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, duckdb::shared_ptr<duckdb::PreparedStatementData, true>&, duckdb::PendingQueryParameters const&) 
duckdb::ClientContext::PendingStatementOrPreparedStatementInternal(duckdb::ClientContextLock&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, duckdb::shared_ptr<duckdb::PreparedStatementData, true>&, duckdb::PendingQueryParameters const&) 
duckdb::ClientContext::PendingQueryInternal(duckdb::ClientContextLock&, duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, duckdb::PendingQueryParameters const&, bool) 
duckdb::ClientContext::PendingQuery(duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, duckdb::BoundParameterData, duckdb::CaseInsensitiveStringHashFunction, duckdb::CaseInsensitiveStringEquality, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, duckdb::BoundParameterData> > >&, bool) 
duckdb::ClientContext::PendingQuery(duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, bool) 
duckdb::Connection::PendingQuery(duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, bool) 
duckdb_shell_sqlite3_prepare_v2 
duckdb_shell::ShellState::ExecuteSQL(char const*, char**) 
duckdb_shell::ShellState::RunOneSqlLine(duckdb_shell::InputMode, char*) 
duckdb_shell::ShellState::ProcessInput(duckdb_shell::InputMode) 
main 
_start