diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
index 216459c..0c6ff0b 100644
--- a/src/regexp_nfa.c
+++ b/src/regexp_nfa.c
@@ -6458,6 +6458,7 @@
 	    if (add_state != NULL)
 	    {
 		nfa_pim_T *pim;
+		nfa_pim_T pim_copy;
 
 		if (t->pim.result == NFA_PIM_UNUSED)
 		    pim = NULL;
@@ -6531,6 +6532,15 @@
 		    pim = NULL;
 		}
 
+		/* If "pim" points into l->t it will become invalid when
+		 * adding the state causes the list to be reallocated.  Make a
+		 * local copy to avoid that. */
+		if (pim == &t->pim)
+		{
+		    copy_pim(&pim_copy, pim);
+		    pim = &pim_copy;
+		}
+
 		if (add_here)
 		    addstate_here(thislist, add_state, &t->subs, pim, &listidx);
 		else