diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
index 7b2dcbe8b..0ca25240f 100644
--- a/lib/tokenize.cpp
+++ b/lib/tokenize.cpp
@@ -6399,9 +6399,9 @@ bool Tokenizer::simplifyKnownVariablesSimplify(Token **tok2, Token *tok3, unsign
         }
 
         // Using the variable in condition..
-        if (Token::Match(tok3->previous(), ("if ( " + structname + " %varid% %comp%|)").c_str(), varid) ||
+        if (Token::Match(tok3->previous(), ("if ( " + structname + " %varid% %cop%|)").c_str(), varid) ||
             Token::Match(tok3, ("( " + structname + " %varid% %comp%").c_str(), varid) ||
-            Token::Match(tok3, ("%comp%|! " + structname + " %varid% %comp%|)|;").c_str(), varid) ||
+            Token::Match(tok3, ("%comp%|!|= " + structname + " %varid% %cop%|)|;").c_str(), varid) ||
             Token::Match(tok3->previous(), "strlen|free ( %varid% )", varid)) {
             if (value[0] == '\"' && tok3->previous()->str() != "strlen") {
                 // bail out if value is a string unless if it's just given
diff --git a/test/testnullpointer.cpp b/test/testnullpointer.cpp
index 2bd63fc92..f98674f15 100644
--- a/test/testnullpointer.cpp
+++ b/test/testnullpointer.cpp
@@ -54,7 +54,6 @@ private:
         TEST_CASE(nullpointer19); // #3811
         TEST_CASE(nullpointer20); // #3807 (fp: return p ? (p->x() || p->y()) : z)
         TEST_CASE(nullpointer21); // #4038 (fp: if (x) p=q; else return;)
-        TEST_CASE(nullpointer22); // #4007 (fp: (uri != NULL) && (*uri == 0))
         TEST_CASE(nullpointer23); // #4665 (false positive)
         TEST_CASE(nullpointer_cast); // #4692
         TEST_CASE(nullpointer_castToVoid); // #3771
@@ -891,12 +890,6 @@ private:
               "}");
         ASSERT_EQUALS("", errout.str());
 
-        check("void f() {\n"
-              "    Foo *p = 0;\n"
-              "    bool b = (p && (p->type() == 1));\n"
-              "}");
-        ASSERT_EQUALS("", errout.str());
-
         check("void foo()\n"
               "{\n"
               "    int sz = sizeof((*(struct dummy *)0).x);\n"
@@ -1237,14 +1230,6 @@ private:
         ASSERT_EQUALS("", errout.str());
     }
 
-    void nullpointer22() {  // #4007 - fp: (x != NULL) && (*x == 0)
-        check("void f() {\n"
-              "    int *p; p = 0;\n"
-              "    int result = p && (!*p);\n"
-              "}");
-        ASSERT_EQUALS("", errout.str());
-    }
-
     void nullpointer23() {  // #4665
         check("void f(){\n"
               "    char *c = NULL;\n"
diff --git a/test/testtokenize.cpp b/test/testtokenize.cpp
index 36c2d2816..0128a9c4b 100644
--- a/test/testtokenize.cpp
+++ b/test/testtokenize.cpp
@@ -173,6 +173,7 @@ private:
         TEST_CASE(simplifyKnownVariables49);    // #3691 - continue in switch
         TEST_CASE(simplifyKnownVariables50);    // #4066 sprintf changes
         TEST_CASE(simplifyKnownVariables51);    // #4409 hang
+        TEST_CASE(simplifyKnownVariables52);    // #4728 bitand
         TEST_CASE(simplifyKnownVariablesIfEq1); // if (a==5) => a is 5 in the block
         TEST_CASE(simplifyKnownVariablesIfEq2); // if (a==5) { buf[a++] = 0; }
         TEST_CASE(simplifyKnownVariablesBailOutAssign1);
@@ -2691,6 +2692,12 @@ private:
         tokenizeAndStringify(code, true); // don't hang
     }
 
+    void simplifyKnownVariables52() { // #4728 bitand
+        const char code[] = "void f() { int x=34; int y=x&z; }";
+        ASSERT_EQUALS("void f ( ) { int y ; y = 34 & z ; }",
+                      tokenizeAndStringify(code, true));
+    }
+
     void simplifyKnownVariablesIfEq1() {
         const char code[] = "void f(int x) {\n"
                             "    if (x==5) {\n"