diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6209b256f..d6785e32b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,7 @@ BUG FIXES:
       marked as tainted. [GH-434]
   * core: Set types are validated to be sets. [GH-413]
   * core: Fix crash case when destroying with tainted resources. [GH-412]
+  * core: Don't execute provisioners in some cases on destroy.
   * providers/aws: Refresh of launch configs and autoscale groups load
       the correct data and don't incorrectly recreate themselves. [GH-425]
   * providers/aws: Fix case where ELB would incorrectly plan to modify
diff --git a/terraform/context.go b/terraform/context.go
index 2cd510f5b..6fa793873 100644
--- a/terraform/context.go
+++ b/terraform/context.go
@@ -700,7 +700,7 @@ func (c *walkContext) applyWalkFn() depgraph.WalkFunc {
 		// We create a new instance if there was no ID
 		// previously or the diff requires re-creating the
 		// underlying instance
-		createNew := is.ID == "" || diff.RequiresNew()
+		createNew := (is.ID == "" && !diff.Destroy) || diff.RequiresNew()
 
 		// With the completed diff, apply!
 		log.Printf("[DEBUG] %s: Executing Apply", r.Id)
diff --git a/terraform/context_test.go b/terraform/context_test.go
index 105c2c0a3..16f1be98b 100644
--- a/terraform/context_test.go
+++ b/terraform/context_test.go
@@ -2067,6 +2067,71 @@ func TestContextApply_destroyOrphan(t *testing.T) {
 	}
 }
 
+func TestContextApply_destroyTaintedProvisioner(t *testing.T) {
+	m := testModule(t, "apply-destroy-provisioner")
+	p := testProvider("aws")
+	pr := testProvisioner()
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+
+	called := false
+	pr.ApplyFn = func(rs *InstanceState, c *ResourceConfig) error {
+		called = true
+		return nil
+	}
+
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Tainted: []*InstanceState{
+							&InstanceState{
+								ID: "bar",
+								Attributes: map[string]string{
+									"id": "bar",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	ctx := testContext(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+		State: s,
+	})
+
+	if _, err := ctx.Plan(&PlanOpts{Destroy: true}); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if called {
+		t.Fatal("provisioner should not be called")
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace("<no state>")
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
 func TestContextApply_error(t *testing.T) {
 	errored := false
 
diff --git a/terraform/test-fixtures/apply-destroy-provisioner/main.tf b/terraform/test-fixtures/apply-destroy-provisioner/main.tf
new file mode 100644
index 000000000..398e2deec
--- /dev/null
+++ b/terraform/test-fixtures/apply-destroy-provisioner/main.tf
@@ -0,0 +1,5 @@
+resource "aws_instance" "foo" {
+    id = "foo"
+
+    provisioner "shell" {}
+}