In builtins/read.def (from bash-3.0.tar.gz):
677 old_attempted_completion_function = rl_attempted_completion_function;
678 rl_attempted_completion_function = (rl_completion_func_t *)NULL;
679 ret = readline (p);
680 rl_attempted_completion_function = old_attempted_completion_function;
I suspect that, in the case of timeout, the old function is never
restored, and remains NULL. (I'm puzzled that this isn't repeatable,
unless readline is completely disabled.)
I hope this makes sense to somebody, because the signal handling code
and add_unwind_protect looks... scary, and out of my depth to patch.
Phil