TemplateSimplifier: Fixed crash caused by null pointer dereference. I don't have a testcase. But the code is suspicious, in the loop we check if tok3 is null and then in the loop head we call tok3->next().