diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index dddc5d1fa..6fdcce5c6 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -15,6 +15,7 @@ This release also fixes a number of problems identified in fish 3.5.0.
 - ``status fish-path`` on Linux-based platforms could print the path with a " (deleted)" suffix (such as ``/usr/bin/fish (deleted)``), which is now removed (:issue:`9019`).
 - Cancelling an initial command (from fish's ``--init-command`` option) with :kbd:`Control-C` no longer prevents configuration scripts from running (:issue:`9024`).
 - The job summary contained extra blank lines if the prompt used multiple lines, which is now fixed (:issue:`9044`).
+- Using special input functions in bindings, in combination with ``and``/``or`` conditionals, no longer crashes (:issue:`9051`).
 
 --------------
 
diff --git a/src/input.cpp b/src/input.cpp
index e360ffa1e..d2b743d84 100644
--- a/src/input.cpp
+++ b/src/input.cpp
@@ -755,12 +755,12 @@ char_event_t inputter_t::read_char(const command_handler_t &command_handler) {
                 }
                 case readline_cmd_t::func_and:
                 case readline_cmd_t::func_or: {
-                    // If previous function has right status, we keep reading tokens
+                    // If previous function has correct status, we keep reading tokens
                     if (evt.get_readline() == readline_cmd_t::func_and) {
-                        if (function_status_) return readch();
+                        // Don't return immediately, we might need to handle it here - like self-insert.
+                        if (function_status_) continue;
                     } else {
-                        assert(evt.get_readline() == readline_cmd_t::func_or);
-                        if (!function_status_) return readch();
+                        if (!function_status_) continue;
                     }
                     // Else we flush remaining tokens
                     do {
diff --git a/tests/pexpects/bind.py b/tests/pexpects/bind.py
index 841eae959..deb7089be 100644
--- a/tests/pexpects/bind.py
+++ b/tests/pexpects/bind.py
@@ -292,6 +292,16 @@ send("echo git@github.com:fish-shell/fish-shell")
 send("\x17\x17\x17\r")
 expect_prompt("git@", unmatched="ctrl-w does not stop at @")
 
+sendline("abbr --add foo 'echo foonanana'")
+expect_prompt()
+sendline("bind ' ' expand-abbr or self-insert")
+expect_prompt()
+send("foo ")
+expect_str("echo foonanana")
+send(" banana\r")
+expect_str(" banana\r")
+expect_prompt("foonanana banana")
+
 # Ensure that nul can be bound properly (#3189).
 send("bind -k nul 'echo nul seen'\r")
 expect_prompt()