diff --git a/src/Val.cc b/src/Val.cc
index 3c561ff81f..7f8d76cebc 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -2768,8 +2768,8 @@ ValPtr TableVal::DoClone(CloneState* state)
 
 		// As network_time is not necessarily initialized yet, we set
 		// a timer which fires immediately.
-		timer = new TableValTimer(this, 1);
-		detail::timer_mgr->Add(timer);
+		tv->timer = new TableValTimer(tv.get(), 1);
+		detail::timer_mgr->Add(tv->timer);
 		}
 
 	if ( expire_func )
diff --git a/testing/btest/language/expire-redef.zeek b/testing/btest/language/expire-redef.zeek
index 3958ef8342..10906a2b91 100644
--- a/testing/btest/language/expire-redef.zeek
+++ b/testing/btest/language/expire-redef.zeek
@@ -35,3 +35,9 @@ event zeek_init() &priority=-10
 	data[0] = "some data";
 	schedule 4sec { do_it() };
 	}
+
+# Test that re-defing a table with an expiry in a specific way
+# does not crash Zeek; see GH-1687.
+
+global hosts: set[addr] &create_expire=1day &redef;
+redef hosts: set[addr] = {};