double bind variable expansion in activerecord condtions

When specifying the table name in an ActiveRecord model scope, the bind variables expansion runs when it should not:

>> Action.scoped(:conditions => {:actions => {:message => ["is this fun?", "hats are nice"]}})
ActiveRecord::PreparedStatementInvalid: wrong number of bind variables (0 for 1) in: `actions`.`message` IN ('is this fun?','hats are nice')

These forms all work as expected:

>> # no question mark
>> Action.scoped(:conditions => {:actions => {:message => ["is this fun", "hats are nice"]}})
Action Load (1.0ms)  SELECT * FROM `actions` WHERE (`actions`.`message` IN ('is this fun','hats are nice'))

>> # no table name
>> Action.scoped(:conditions => {:message => ["is this fun?", "hats are nice"]})
Action Load (1.0ms)  SELECT * FROM `actions` WHERE (`actions`.`message` IN ('is this fun?','hats are nice'))

>> # no nesting
>> Action.scoped(:conditions => {"actions.message" => ["is this fun?", "hats are nice"]})
Action Load (1.0ms)  SELECT * FROM `actions` WHERE (`actions`.`message` IN ('is this fun?','hats are nice'))

I believe the problem is that sanitize_sql_hash_for_conditions calls itself recursively after generating the table name, and expand_range_bind_variables is called twice instead of once as it unwinds.

https://github.com/rails/rails/blob/2-3-stable/activerecord/lib/act...
https://github.com/rails/rails/blob/2-3-stable/activerecord/lib/act...