I do not see a crash on 5.1.73 or 5.5 (no fulltext keys there for InnoDB, so no wonder...), but on 5.6 it's easy to reproduce:

[openxs@chief p5.6]$ bin/mysql --no-defaults -uroot test
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 1
Server version: 5.6.21-69.0 MySQL Community Server (GPL)

Copyright (c) 2009-2014 Percona LLC and/or its affiliates
Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> create table t1(pk1 int key,b bit,key(b)) ENGINE=INNODB;
Query OK, 0 rows affected (0.30 sec)

mysql> CREATE TABLE t2(a int,b2 char,FULLTEXT KEY b2 (b2));
Query OK, 0 rows affected (1.55 sec)

mysql> EXPLAIN EXTENDED SELECT * FROM t1 UNION SELECT * FROM t1 ORDER BY(SELECT a FROM t2 WHERE b=12);
+----+--------------------+------------+-------+---------------+------+---------+------+------+----------+---------------------------------+
| id | select_type        | table      | type  | possible_keys | key  | key_len | ref  | rows | filtered | Extra                           |
+----+--------------------+------------+-------+---------------+------+---------+------+------+----------+---------------------------------+
|  1 | PRIMARY            | t1         | index | NULL          | b    | 2       | NULL |    1 |   100.00 | Using index                     |
|  2 | UNION              | t1         | index | NULL          | b    | 2       | NULL |    1 |   100.00 | Using index                     |
|  3 | DEPENDENT SUBQUERY | t2         | ALL   | NULL          | NULL | NULL    | NULL |    1 |   100.00 | Using where                     |
| NULL | UNION RESULT       | <union1,2> | ALL   | NULL          | NULL | NULL    | NULL | NULL |     NULL | Using temporary; Using filesort |
+----+--------------------+------------+-------+---------------+------+---------+------+------+----------+---------------------------------+
4 rows in set, 2 warnings (0.00 sec)

mysql> UPDATE t2 SET a=1 ORDER BY a;
ERROR 2013 (HY000): Lost connection to MySQL server during query
mysql> 141027 11:16:39 mysqld_safe Number of processes running now: 0
141027 11:16:39 mysqld_safe mysqld restarted

mysql> exit
Bye
[openxs@chief p5.6]$ tail -120 data/chief.err
...

2014-10-27 11:16:22 3023 [Note] /home/openxs/dbs/p5.6/bin/mysqld: ready for connections.
Version: '5.6.21-69.0'  socket: '/tmp/mysql.sock'  port: 3306  MySQL Community Server (GPL)
pure virtual method called
terminate called without an active exception
09:16:38 UTC - mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed,
something is definitely wrong and this may fail.
Please help us make Percona Server better by reporting any
bugs at http://bugs.percona.com/

key_buffer_size=8388608
read_buffer_size=131072
max_used_connections=1
max_threads=153
thread_count=1
connection_count=1
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 69184 K  bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x7fac0df92000
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 7fac1e586df0 thread_stack 0x40000
/home/openxs/dbs/p5.6/bin/mysqld(my_print_stacktrace+0x35)[0x907f05]
/home/openxs/dbs/p5.6/bin/mysqld(handle_fatal_signal+0x4b4)[0x66f184]
/lib64/libpthread.so.0[0x3ffac0eeb0]
/lib64/libc.so.6(gsignal+0x35)[0x3ffa8330c5]
/lib64/libc.so.6(abort+0x186)[0x3ffa834a76]
/usr/lib64/libstdc++.so.6(_ZN9__gnu_cxx27__verbose_terminate_handlerEv+0x11d)[0x30060bc08d]
/usr/lib64/libstdc++.so.6[0x30060ba2a6]
/usr/lib64/libstdc++.so.6[0x30060ba2d3]
/usr/lib64/libstdc++.so.6[0x30060bac2f]
/home/openxs/dbs/p5.6/bin/mysqld(_Z8filesortP3THDP5TABLEP8FilesortbPyS5_+0x5fe)[0x7f103e]
/home/openxs/dbs/p5.6/bin/mysqld(_Z12mysql_updateP3THDP10TABLE_LISTR4ListI4ItemES6_PS4_jP8st_ordery15enum_duplicatesbPySB_+0xa74)[0x761af4]
/home/openxs/dbs/p5.6/bin/mysqld(_Z21mysql_execute_commandP3THD+0x230e)[0x6f076e]
/home/openxs/dbs/p5.6/bin/mysqld(_Z11mysql_parseP3THDPcjP12Parser_state+0x618)[0x6f6af8]
/home/openxs/dbs/p5.6/bin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0x15c5)[0x6f8155]
/home/openxs/dbs/p5.6/bin/mysqld(_Z24do_handle_one_connectionP3THD+0x15f)[0x6c18cf]
/home/openxs/dbs/p5.6/bin/mysqld(handle_one_connection+0x47)[0x6c19a7]
/home/openxs/dbs/p5.6/bin/mysqld(pfs_spawn_thread+0x12a)[0x99589a]
/lib64/libpthread.so.0[0x3ffac06ccb]
/lib64/libc.so.6(clone+0x6d)[0x3ffa8e0c2d]

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (7fabffc1d010): UPDATE t2 SET a=1 ORDER BY a
Connection ID (thread ID): 1
Status: NOT_KILLED