`NULLIF` causes interface conversion panic

## Bug Report

Using `NULLIF` in a WHERE clause causes TiDB to crash with an `interface conversion` panic.

### 1. Minimal reproduce step (Required)

```sql
DROP DATABASE IF EXISTS testdb;
CREATE DATABASE testdb;
USE testdb;
CREATE TABLE t0(c0 INT);
CREATE TABLE t1(c0 INT);

SELECT 1 FROM t0, t1 WHERE NULLIF(1 | 1, t1.c0) = t0.c0;
```

### 2. What did you expect to see? (Required)

The query should execute normally and return a result set (possibly empty), or produce a normal SQL error if the expression is invalid. It should not crash the server.

### 3. What did you see instead (Required)

TiDB crashes with the following error:

```
interface conversion: expression.Expression is *expression.ScalarFunction, not *expression.Column
```

### 4. What is your TiDB version? (Required)

```
Release Version: v8.5.6
Edition: Community
Git Commit Hash: ae18096e023780bb56bfce33698abec0d4640d0a
Git Branch: HEAD
UTC Build Time: 2026-06-04 05:49:11
GoVersion: go1.25.8
Race Enabled: false
Check Table Before Drop: false
Store: unistore
```