diff --git a/lib/programmemory.cpp b/lib/programmemory.cpp
index 1cddaee0f..aafa2c862 100644
--- a/lib/programmemory.cpp
+++ b/lib/programmemory.cpp
@@ -1416,7 +1416,7 @@ static ValueFlow::Value execute(const Token* expr, ProgramMemory& pm, const Sett
         return v;
     if (!expr)
         return v;
-    if (pm.hasValue(expr->exprId()))
+    if (expr->exprId() > 0 && pm.hasValue(expr->exprId()))
         return pm.at(expr->exprId());
     if (const ValueFlow::Value* value = getImpossibleValue(expr))
         return *value;
diff --git a/test/testnullpointer.cpp b/test/testnullpointer.cpp
index 8172e0857..2452ecefb 100644
--- a/test/testnullpointer.cpp
+++ b/test/testnullpointer.cpp
@@ -143,6 +143,7 @@ private:
         TEST_CASE(nullpointer97); // #11229
         TEST_CASE(nullpointer98); // #11458
         TEST_CASE(nullpointer99); // #10602
+        TEST_CASE(nullpointer100);        // #11636
         TEST_CASE(nullpointer_addressOf); // address of
         TEST_CASE(nullpointerSwitch); // #2626
         TEST_CASE(nullpointer_cast); // #4692
@@ -2830,6 +2831,17 @@ private:
         ASSERT_EQUALS("[test.cpp:14]: (error) Null pointer dereference: buf\n", errout.str());
     }
 
+    void nullpointer100() // #11636
+    {
+        check("const char* type_of(double) { return \"unknown\"; }\n"
+              "void f() {\n"
+              "    double tmp = 0.0;\n"
+              "    const char* t = type_of(tmp);\n"
+              "    std::cout << t;\n"
+              "}\n");
+        ASSERT_EQUALS("", errout.str());
+    }
+
     void nullpointer_addressOf() { // address of
         check("void f() {\n"
               "  struct X *x = 0;\n"