diff --git a/src/expr.c b/src/expr.c
index c9d8bb4..4ee225b 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -1193,6 +1193,7 @@ gnm_expr_eval (GnmExpr const *expr, GnmEvalPos const *pos,
 	case GNM_EXPR_OP_LT:
 	case GNM_EXPR_OP_LTE:
 		flags |= GNM_EXPR_EVAL_PERMIT_EMPTY;
+		flags &= ~GNM_EXPR_EVAL_WANT_REF;
 
 		a = gnm_expr_eval (expr->binary.value_a, pos, flags);
 		if (a != NULL) {
@@ -1238,6 +1239,7 @@ gnm_expr_eval (GnmExpr const *expr, GnmEvalPos const *pos,
 
 		/* Guarantees value != NULL */
 		flags &= ~GNM_EXPR_EVAL_PERMIT_EMPTY;
+		flags &= ~GNM_EXPR_EVAL_WANT_REF;
 
 		/* 1) Error from A */
 		a = gnm_expr_eval (expr->binary.value_a, pos, flags);
@@ -1312,6 +1314,7 @@ gnm_expr_eval (GnmExpr const *expr, GnmEvalPos const *pos,
 	case GNM_EXPR_OP_UNARY_PLUS:
 		/* Guarantees value != NULL */
 		flags &= ~GNM_EXPR_EVAL_PERMIT_EMPTY;
+		flags &= ~GNM_EXPR_EVAL_WANT_REF;
 
 		a = gnm_expr_eval (expr->unary.value, pos, flags);
 		if (VALUE_IS_ERROR (a))
@@ -1352,6 +1355,7 @@ gnm_expr_eval (GnmExpr const *expr, GnmEvalPos const *pos,
 
 	case GNM_EXPR_OP_CAT:
 		flags |= GNM_EXPR_EVAL_PERMIT_EMPTY;
+		flags &= ~GNM_EXPR_EVAL_WANT_REF;
 		a = gnm_expr_eval (expr->binary.value_a, pos, flags);
 		if (a != NULL) {
 			if (VALUE_IS_ERROR (a))
@@ -1426,19 +1430,21 @@ gnm_expr_eval (GnmExpr const *expr, GnmEvalPos const *pos,
 
 	case GNM_EXPR_OP_CELLREF: {
 		GnmCell *cell;
-		GnmCellPos dest;
+		GnmCellRef r;
 
-		gnm_cellpos_init_cellref (&dest, &expr->cellref.ref,
-					  &pos->eval, pos->sheet);
+		gnm_cellref_make_abs (&r, &expr->cellref.ref, pos);
 
-		cell = sheet_cell_get (eval_sheet (expr->cellref.ref.sheet, pos->sheet),
-			dest.col, dest.row);
-		if (cell == NULL)
-			return handle_empty (NULL, flags);
-
-		gnm_cell_eval (cell);
+		cell = sheet_cell_get (eval_sheet (r.sheet, pos->sheet),
+				       r.col, r.row);
+		if (cell)
+			gnm_cell_eval (cell);
 
-		return handle_empty (value_dup (cell->value), flags);
+		if (flags & GNM_EXPR_EVAL_WANT_REF) {
+			return value_new_cellrange_unsafe (&r, &r);
+		} else {
+			GnmValue *v = cell ? value_dup (cell->value) : NULL;
+			return handle_empty (v, flags);
+		}
 	}
 
 	case GNM_EXPR_OP_CONSTANT:
diff --git a/src/func.c b/src/func.c
index a08f80f..58a322d 100644
--- a/src/func.c
+++ b/src/func.c
@@ -1248,26 +1248,22 @@ function_call_with_exprs (GnmFuncEvalInfo *ei, GnmExprEvalFlags flags)
 		GnmExpr const *expr = argv[i];
 
 		if (arg_type == 'A' || arg_type == 'r') {
-			if (GNM_EXPR_GET_OPER (expr) == GNM_EXPR_OP_CELLREF) {
-				GnmCellRef r;
-				gnm_cellref_make_abs (&r, &expr->cellref.ref, ei->pos);
-				args[i] = value_new_cellrange_unsafe (&r, &r);
-			} else {
-				tmp = args[i] = gnm_expr_eval (expr, ei->pos,
-					GNM_EXPR_EVAL_PERMIT_NON_SCALAR);
-				if (tmp->type == VALUE_CELLRANGE) {
-					gnm_cellref_make_abs (&tmp->v_range.cell.a,
-						&tmp->v_range.cell.a,
-						ei->pos);
-					gnm_cellref_make_abs (&tmp->v_range.cell.b,
-						&tmp->v_range.cell.b,
-						ei->pos);
+			tmp = args[i] = gnm_expr_eval
+				(expr, ei->pos,
+				 GNM_EXPR_EVAL_PERMIT_NON_SCALAR |
+				 GNM_EXPR_EVAL_WANT_REF);
+			if (tmp->type == VALUE_CELLRANGE) {
+				gnm_cellref_make_abs (&tmp->v_range.cell.a,
+						      &tmp->v_range.cell.a,
+						      ei->pos);
+				gnm_cellref_make_abs (&tmp->v_range.cell.b,
+						      &tmp->v_range.cell.b,
+						      ei->pos);
 
 				/* Array args accept scalars */
-				} else if (arg_type != 'A' && tmp->type != VALUE_ARRAY) {
-					free_values (args, i + 1);
-					return value_new_error_VALUE (ei->pos);
-				}
+			} else if (arg_type != 'A' && tmp->type != VALUE_ARRAY) {
+				free_values (args, i + 1);
+				return value_new_error_VALUE (ei->pos);
 			}
 			continue;
 		}
diff --git a/src/gnumeric.h b/src/gnumeric.h
index bd2de8d..033d5cd 100644
--- a/src/gnumeric.h
+++ b/src/gnumeric.h
@@ -166,7 +166,8 @@ typedef enum {
 typedef enum {
 	GNM_EXPR_EVAL_SCALAR_NON_EMPTY	= 0,
 	GNM_EXPR_EVAL_PERMIT_NON_SCALAR	= 0x1,
-	GNM_EXPR_EVAL_PERMIT_EMPTY	= 0x2
+	GNM_EXPR_EVAL_PERMIT_EMPTY	= 0x2,
+	GNM_EXPR_EVAL_WANT_REF		= 0x4
 } GnmExprEvalFlags;
 
 typedef struct _XmlParseContext		XmlParseContext;
