The issue is that UnknownVal is produced for an array element when it is used in expressions with unknown bounds and unknown index. Thus it doesn't bind in the list of Expressions and never be used twice then.
Produce symbolic values for array elements instead of UnknownVal. This also enables to bind these values and use them later in the next expressions.
This fixes https://bugs.llvm.org/show_bug.cgi?id=9289