diff --git a/CHANGELOG b/CHANGELOG
index ecd5e429a..91a4954b1 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,9 @@
 # Nmap Changelog ($Id$); -*-text-*-
 
+o Fixed an assertion failure caused when a host had NSE scripts in
+  multiple runlevels.  This in turn also fixes --host-timeout behavior
+  in NSE. [Kris]
+
 o Removed the "class" attribute from the tcpsequence element in XML
   output. For a long time it had always been "unknown class" because
   Nmap doesn't calculate a class anymore. The XML output version has
diff --git a/nse_main.cc b/nse_main.cc
index f25116350..439fb5ec8 100644
--- a/nse_main.cc
+++ b/nse_main.cc
@@ -145,6 +145,7 @@ int script_scan(std::vector<Target*> &targets) {
 	int status;
 	std::vector<Target*>::iterator target_iter;
 	std::list<std::list<struct thread_record> >::iterator runlevel_iter;
+	std::list<struct thread_record>::iterator thr_iter;
 	std::list<struct thread_record> torun_threads;
 	lua_State* l;
 
@@ -212,6 +213,15 @@ int script_scan(std::vector<Target*> &targets) {
 					SCRIPT_ENGINE,
 					running_scripts.front().runlevel);)
 
+		/* Start the time-out clocks for targets with scripts in this
+		 * runlevel.  The clock is stopped in process_finalize().
+		 */
+		for (thr_iter = running_scripts.begin();
+		     thr_iter != running_scripts.end();
+		     thr_iter++)
+			if (!thr_iter->rr->host->timeOutClockRunning())
+				thr_iter->rr->host->startTimeOutClock(NULL);
+
 		status = process_mainloop(l);
 		if(status != SCRIPT_ENGINE_SUCCESS){
 			goto finishup;
@@ -343,7 +353,8 @@ int process_mainloop(lua_State* l) {
 }
 
 // If the target still has scripts in either running_scripts
-// or waiting_scripts then it is still running
+// or waiting_scripts then it is still running.  This only
+// pertains to scripts in the current runlevel.
 
 int has_target_finished(Target *target) {
 	std::list<struct thread_record>::iterator iter;
@@ -442,9 +453,6 @@ int process_preparehost(lua_State* l, Target* target, std::list<struct thread_re
 	std::vector<run_record>::iterator iter;
 	struct run_record rr;
 
-	if (!target->timeOutClockRunning())
-		target->startTimeOutClock(NULL);
-
 	/* find the matching hostrules
 	 * */
 	lua_getglobal(l, HOSTTESTS);