Found in https://s3.amazonaws.com/clickhouse-test-reports/38900/e3ef3a2b41214093f6f2ab645abc7fe42b5fd60d/fuzzer_astfuzzerubsan//report.html

```
../src/Functions/FunctionHashID.h:72:60: runtime error: reference binding to null pointer of type 'const DB::IColumn' Received signal -3 Received signal Unknown signal (-3)
```

Query:
```
SET allow_experimental_hash_functions = 1

SELECT
    JSONExtractRaw(257, NULL),
    hashid(1024, if(rand() % 10, 'truetruetruetrue', NULL), 's3\0r3t')
```

Reproduces in official releases (without ubsan too):
```
$ ./clickhouse-common-static-22.7.1.2484/usr/bin/clickhouse local
ClickHouse local version 22.7.1.2484 (official build).

Mordor :) SELECT JSONExtractRaw(257, NULL), hashid(1024, if(rand() % 10, 'truetruetruetrue', NULL), 's3\0r3t') SETTINGS allow_experimental_hash_functions = 1;

SELECT
    JSONExtractRaw(257, NULL),
    hashid(1024, if(rand() % 10, 'truetruetruetrue', NULL), 's3\0r3t')
SETTINGS allow_experimental_hash_functions = 1

Query id: c9692a34-e667-4bde-b95a-30d93dbdc3d6

Aborted (core dumped)
```

Coredump from 22.7:
```
(gdb) bt
#0  0x00007f29b3a8e36c in ?? () from /usr/lib/libc.so.6
#1  0x00007f29b3a3e838 in raise () from /usr/lib/libc.so.6
#2  0x00007f29b3a28535 in abort () from /usr/lib/libc.so.6
#3  0x000000001ab3b04c in Poco::SignalHandler::handleSignal(int) ()
#4  <signal handler called>
#5  0x000000000f3e43b4 in DB::FunctionHashID::getReturnTypeImpl(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&) const ()
#6  0x0000000015c01c32 in DB::IFunctionOverloadResolver::getReturnTypeWithoutLowCardinality(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&) const ()
#7  0x0000000015c011be in DB::IFunctionOverloadResolver::getReturnType(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&) const ()
#8  0x0000000015c02096 in DB::IFunctionOverloadResolver::build(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&) const ()
#9  0x000000001638ad35 in DB::ActionsDAG::addFunction(std::__1::shared_ptr<DB::IFunctionOverloadResolver> const&, std::__1::vector<DB::ActionsDAG::Node const*, std::__1::allocator<DB::ActionsDAG::Node const*> >, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >) ()
#10 0x00000000166f9099 in DB::ScopeStack::addFunction(std::__1::shared_ptr<DB::IFunctionOverloadResolver> const&, std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >) ()
#11 0x00000000167028af in DB::ActionsMatcher::Data::addFunction(std::__1::shared_ptr<DB::IFunctionOverloadResolver> const&, std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >) ()
#12 0x00000000166fddda in DB::ActionsMatcher::visit(DB::ASTFunction const&, std::__1::shared_ptr<DB::IAST> const&, DB::ActionsMatcher::Data&) ()
#13 0x0000000016700678 in DB::ActionsMatcher::visit(DB::ASTExpressionList&, std::__1::shared_ptr<DB::IAST> const&, DB::ActionsMatcher::Data&) ()
#14 0x00000000166c1877 in DB::InDepthNodeVisitor<DB::ActionsMatcher, true, false, std::__1::shared_ptr<DB::IAST> const>::visit(std::__1::shared_ptr<DB::IAST> const&) ()
#15 0x00000000166c1674 in DB::ExpressionAnalyzer::getRootActions(std::__1::shared_ptr<DB::IAST> const&, bool, std::__1::shared_ptr<DB::ActionsDAG>&, bool) ()
#16 0x00000000166cfd65 in DB::SelectQueryExpressionAnalyzer::appendSelect(DB::ExpressionActionsChain&, bool) ()
#17 0x00000000166d4e1a in DB::ExpressionAnalysisResult::ExpressionAnalysisResult(DB::SelectQueryExpressionAnalyzer&, std::__1::shared_ptr<DB::StorageInMemoryMetadata const> const&, bool, bool, bool, std::__1::shared_ptr<DB::FilterDAGInfo> const&, std::__1::shared_ptr<DB::FilterDAGInfo> const&, DB::Block const&)
    ()
#18 0x0000000016ba570d in DB::InterpreterSelectQuery::getSampleBlockImpl() ()
#19 0x0000000016b9d15b in ?? ()
#20 0x0000000016b97880 in DB::InterpreterSelectQuery::InterpreterSelectQuery(std::__1::shared_ptr<DB::IAST> const&, std::__1::shared_ptr<DB::Context> const&, std::__1::optional<DB::Pipe>, std::__1::shared_ptr<DB::IStorage> const&, DB::SelectQueryOptions const&, std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&, std::__1::shared_ptr<DB::StorageInMemoryMetadata const> const&, std::__1::unordered_map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, DB::SubqueryForSet, std::__1::hash<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::equal_to<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const, DB::SubqueryForSet> > >, std::__1::unordered_map<DB::PreparedSetKey, std::__1::shared_ptr<DB::Set>, DB::PreparedSetKey::Hash, std::__1::equal_to<DB::PreparedSetKey>, std::__1::allocator<std::__1::pair<DB::PreparedSetKey const, std::__1::shared_ptr<DB::Set> > > >) ()
#21 0x0000000016b94d17 in DB::InterpreterSelectQuery::InterpreterSelectQuery(std::__1::shared_ptr<DB::IAST> const&, std::__1::shared_ptr<DB::Context> const&, DB::SelectQueryOptions const&, std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) ()
#22 0x0000000016be5726 in DB::InterpreterSelectWithUnionQuery::buildCurrentChildInterpreter(std::__1::shared_ptr<DB::IAST> const&, std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) ()
#23 0x0000000016be33f4 in DB::InterpreterSelectWithUnionQuery::InterpreterSelectWithUnionQuery(std::__1::shared_ptr<DB::IAST> const&, std::__1::shared_ptr<DB::Context>, DB::SelectQueryOptions const&, std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) ()
#24 0x0000000016b49863 in DB::InterpreterFactory::get(std::__1::shared_ptr<DB::IAST>&, std::__1::shared_ptr<DB::Context>, DB::SelectQueryOptions const&) ()
#25 0x0000000016ecd560 in ?? ()
#26 0x0000000016ecb015 in DB::executeQuery(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::shared_ptr<DB::Context>, bool, DB::QueryProcessingStage::Enum)
    ()
#27 0x000000001788abc1 in DB::LocalConnection::sendQuery(DB::ConnectionTimeouts const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, unsigned long, DB::Settings const*, DB::ClientInfo const*, bool, std::__1::function<void (DB::Progress const&)>) ()
#28 0x000000001783074a in DB::ClientBase::processOrdinaryQuery(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::shared_ptr<DB::IAST>) ()
#29 0x000000001782f57b in DB::ClientBase::processParsedSingleQuery(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::shared_ptr<DB::IAST>, std::__1::optional<bool>, bool) ()
#30 0x000000001782ec96 in DB::ClientBase::processTextAsSingleQuery(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) ()
--Type <RET> for more, q to quit, c to continue without paging--
#31 0x000000001784029d in DB::ClientBase::processQueryText(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) ()
#32 0x0000000017841bdb in DB::ClientBase::runInteractive() ()
#33 0x000000000bb807e5 in DB::LocalServer::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) ()
#34 0x000000001a9a3506 in Poco::Util::Application::run() ()
#35 0x000000000bb88720 in mainEntryClickHouseLocal(int, char**) ()
#36 0x000000000ba31279 in main ()
```
size_t getNumberOfArguments() const override { return 0; }
    bool isVariadic() const override { return true; }
    bool isSuitableForShortCircuitArgumentsExecution(const DataTypesWithConstInfo & ) const override { return false; }
    bool useDefaultImplementationForConstants() const override { return true; }
    DataTypePtr getReturnTypeImpl(const ColumnsWithTypeAndName & arguments) const override
    {
        if (arguments.empty())
            throw Exception(ErrorCodes::TOO_FEW_ARGUMENTS_FOR_FUNCTION, "Function {} expects at least one argument", getName());
        const auto & id_col = arguments[0];
        if (!isUnsignedInteger(id_col.type))
            throw Exception(
                ErrorCodes::ILLEGAL_TYPE_OF_ARGUMENT,
                "First argument of function {} must be unsigned integer, got {}",
                getName(),
                arguments[0].type->getName());
        if (arguments.size() > 1)
        {
            const auto & hash_col = arguments[1];
            if (!isString(hash_col.type) || !isColumnConst(*hash_col.column.get()))
                throw Exception(
                    ErrorCodes::ILLEGAL_TYPE_OF_ARGUMENT,
                    "Second argument of function {} must be String, got {}",
                    getName(),
                    arguments[1].type->getName());
        }
        if (arguments.size() > 2)