diff --git a/0001-do-not-access-token-data-after-token-has-been-destro.patch b/0001-do-not-access-token-data-after-token-has-been-destro.patch
new file mode 100644
index 0000000..dd15104
--- /dev/null
+++ b/0001-do-not-access-token-data-after-token-has-been-destro.patch
@@ -0,0 +1,45 @@
+From 5c894b9e0832c3c899d3116dd0fa9caa9214e7d5 Mon Sep 17 00:00:00 2001
+Message-Id: <5c894b9e0832c3c899d3116dd0fa9caa9214e7d5.1434202005.git.erack@redhat.com>
+From: Eike Rathke <erack@redhat.com>
+Date: Sat, 13 Jun 2015 15:12:32 +0200
+Subject: [PATCH] do not access token data after token has been destroyed
+MIME-Version: 1.0
+Content-Type: multipart/mixed; boundary="------------erAck-patch-parts"
+
+This is a multi-part message in MIME format.
+--------------erAck-patch-parts
+Content-Type: text/plain; charset=UTF-8; format=fixed
+Content-Transfer-Encoding: 8bit
+
+
+Change-Id: I624e64745fd3874be3e1bd3df6bac18dfb17aebb
+(cherry picked from commit c1fc84ac140d519e0bfa7a607e36771682b08eed)
+---
+ sc/source/core/tool/token.cxx | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+
+--------------erAck-patch-parts
+Content-Type: text/x-patch; name="0001-do-not-access-token-data-after-token-has-been-destro.patch"
+Content-Transfer-Encoding: 8bit
+Content-Disposition: attachment; filename="0001-do-not-access-token-data-after-token-has-been-destro.patch"
+
+diff --git a/sc/source/core/tool/token.cxx b/sc/source/core/tool/token.cxx
+index a83ba8e..c4d53c7 100644
+--- a/sc/source/core/tool/token.cxx
++++ b/sc/source/core/tool/token.cxx
+@@ -2377,9 +2377,9 @@ void ScTokenArray::ReadjustAbsolute3DReferences( const ScDocument* pOldDoc, cons
+                     OUString aTabName;
+                     sal_uInt16 nFileId;
+                     GetExternalTableData(pOldDoc, pNewDoc, rRef1.Tab(), aTabName, nFileId);
+-                    pCode[j]->DecRef();
+                     ScExternalDoubleRefToken* pToken = new ScExternalDoubleRefToken(nFileId, aTabName, rRef);
+                     pToken->IncRef();
++                    pCode[j]->DecRef(); // ATTENTION: rRef can't be used after this point
+                     pCode[j] = pToken;
+                 }
+             }
+
+--------------erAck-patch-parts--
+
+
diff --git a/libreoffice.spec b/libreoffice.spec
index d5808d1..9d8fa7d 100644
--- a/libreoffice.spec
+++ b/libreoffice.spec
@@ -390,6 +390,7 @@ Patch78: 0001-rulers-Make-the-numbers-a-bit-smaller-and-always-wit.patch
 Patch79: 0001-Resolves-tdf-91420-Jan1-2015-is-a-valid-date.patch
 Patch80: 0001-tdf-91425-CRASH-Calc-Insert-Columns-Left.patch
 Patch81: 0001-tdf-78854-do-not-crash-when-undoing-layout-change.patch
+Patch82: 0001-do-not-access-token-data-after-token-has-been-destro.patch
 
 %define instdir %{_libdir}
 %define baseinstdir %{instdir}/libreoffice
@@ -2371,6 +2372,9 @@ update-desktop-database %{_datadir}/applications &> /dev/null || :
 - Resolves: tdf#91425 CRASH - Calc Insert Columns Left
 - Resolves: rhbz#1212214 - [abrt] libreoffice-core:
   SdrObjList::RecalcRects(): soffice.bin killed by SIGSEGV
+- do not access token data after token has been destroyed
+  Reference adjustment when copying Calc named expressions to another document
+  may have been incorrect.
 
 * Tue May 19 2015 Caolán McNamara <caolanm@redhat.com> - 1:4.3.7.2-6
 - Resolves: rhbz#1219137 tweak ruler for happenchance side-effect