core dump with prompt_subst and unusual PROMPT [4.3.2,4.2.6,4.2.1]

[Matt Pharr <matt@xxxxxxxxx>]

If I source the following script (extracted from my .zshrc file), zsh  
dumps core--I've reproduced this on 4.2.1, 4.2.6, and 4.3.2.   
Admittedly it's pretty ugly and possibly malformed, though a core  
dump's a core dump...  A representative stack trace (from 4.3.2) is  
below.

thanks,
-matt

--- snip ---
PROMPT='[${{NKAPPDIR##/home/mmp/sw/}%%nkapp}] %(?..err %B%?%b )%(1v.%B 
%v%b .)%B%#%b '

setopt  autocd                  autolist                 
automenu        \
        autoremoveslash         cdablevars      \
        correct                 correctall               
cshnullglob     \
        extendedglob            numericglobsort \
        ignoreeof               listtypes                
longlistjobs    \
        noclobber               notify                   
pathdirs        \
        promptsubst \
        pushdignoredups         pushdtohome              
rcquotes        \
        completeinword          alwaystoend              
listambiguous   \
        alwayslastprompt
setopt  histignoredups          histignorespace          
appendhistory   \
        extendedhistory         histallowclobber        #histsavenodups
unsetopt bgnice      # bleh!

--- snip ---

[mmp@lux]/tmp% source xxx
zsh: bad substitution
*** glibc detected *** zsh: double free or corruption (!prev):  
0x0863e3b8 ***
======= Backtrace: =========
/lib/libc.so.6[0xd28424]
/lib/libc.so.6(__libc_free+0x77)[0xd2895f]
/usr/local/lib/zsh/4.3.2/zsh/zle.so(reexpandprompt+0x20)[0x40249c38]
/usr/local/lib/zsh/4.3.2/zsh/zle.so(zrefresh+0xbef)[0x40251e33]
/usr/local/lib/zsh/4.3.2/zsh/zle.so(trashzle+0x63)[0x40249d5b]
zsh(zwarn+0xa6)[0x80aafe6]
zsh(zerr+0x43)[0x80ab4c3]
zsh(paramsubst+0x5f7)[0x80a180f]
zsh[0x80a53b9]
zsh(prefork+0x75)[0x80a551d]
zsh(singsub+0x35)[0x80a5dc1]
zsh(promptexpand+0x1b5)[0x809de0d]
/usr/local/lib/zsh/4.3.2/zsh/zle.so(reexpandprompt+0x3b)[0x40249c53]
/usr/local/lib/zsh/4.3.2/zsh/zle.so(zrefresh+0xbef)[0x40251e33]
/usr/local/lib/zsh/4.3.2/zsh/zle.so(zleread+0x386)[0x4024a19e]
zsh(ingetc+0x247)[0x8078ec3]
zsh[0x80724d9]
zsh(gettok+0x1e)[0x807fa96]
zsh(yylex+0x15)[0x8080a5d]
zsh(parse_event+0x29)[0x80976a1]
zsh(loop+0x1b9)[0x8075dc9]
zsh(zsh_main+0x1a8)[0x8078548]
/lib/libc.so.6(__libc_start_main+0xc6)[0xcd9de6]
zsh[0x805297d]
======= Memory map: ========
00101000-00123000 r-xp 00000000 08:02 787232     /lib/libm-2.3.5.so
00123000-00124000 r-xp 00021000 08:02 787232     /lib/libm-2.3.5.so
00124000-00125000 rwxp 00022000 08:02 787232     /lib/libm-2.3.5.so
00333000-0033c000 r-xp 00000000 08:02 787235     /lib/ 
libgcc_s-4.0.0-20050520.so.1
0033c000-0033d000 rwxp 00009000 08:02 787235     /lib/ 
libgcc_s-4.0.0-20050520.so.1
0048b000-004a5000 r-xp 00000000 08:02 786576     /lib/ld-2.3.5.so
004a5000-004a6000 r-xp 00019000 08:02 786576     /lib/ld-2.3.5.so
004a6000-004a7000 rwxp 0001a000 08:02 786576     /lib/ld-2.3.5.so
004a9000-004ac000 r-xp 00000000 08:02 787251     /lib/libtermcap.so. 
2.0.8
004ac000-004ad000 rwxp 00002000 08:02 787251     /lib/libtermcap.so. 
2.0.8
00cc5000-00de9000 r-xp 00000000 08:02 787231     /lib/libc-2.3.5.so
00de9000-00deb000 r-xp 00124000 08:02 787231     /lib/libc-2.3.5.so
00deb000-00ded000 rwxp 00126000 08:02 787231     /lib/libc-2.3.5.so
00ded000-00def000 rwxp 00ded000 00:00 0
00df1000-00df3000 r-xp 00000000 08:02 787233     /lib/libdl-2.3.5.so
00df3000-00df4000 r-xp 00001000 08:02 787233     /lib/libdl-2.3.5.so
00df4000-00df5000 rwxp 00002000 08:02 787233     /lib/libdl-2.3.5.so
074e6000-07524000 r-xp 00000000 08:02 1124284    /usr/lib/ 
libncurses.so.5.4
07524000-0752d000 rwxp 0003d000 08:02 1124284    /usr/lib/ 
libncurses.so.5.4
07dc1000-07dd3000 r-xp 00000000 08:02 787242     /lib/libnsl-2.3.5.so
07dd3000-07dd4000 r-xp 00011000 08:02 787242     /lib/libnsl-2.3.5.so
07dd4000-07dd5000 rwxp 00012000 08:02 787242     /lib/libnsl-2.3.5.so
07dd5000-07dd7000 rwxp 07dd5000 00:00 0
08048000-080b6000 r-xp 00000000 08:02 1125404    /usr/local/bin/zsh
080b6000-080ba000 rwxp 0006d000 08:02 1125404    /usr/local/bin/zsh
080ba000-080d1000 rwxp 080ba000 00:00 0
08623000-08686000 rwxp 08623000 00:00 0          [heap]
40000000-40001000 r-xp 40000000 00:00 0
40001000-40002000 rwxp 40001000 00:00 0
40016000-40018000 rwxp 40016000 00:00 0
40018000-40218000 r-xp 00000000 08:02 1116573    /usr/lib/locale/ 
locale-archive
40218000-4021c000 rwxp 40218000 00:00 0
4021c000-40222000 r-xs 00000000 08:02 1116794    /usr/lib/gconv/gconv- 
modules.cache
40223000-40226000 r-xp 00000000 08:02 556946     /usr/local/lib/zsh/ 
4.3.2/zsh/rlimits.so
40226000-40227000 rwxp 00002000 08:02 556946     /usr/local/lib/zsh/ 
4.3.2/zsh/rlimits.so
4022c000-40235000 r-xp 00000000 08:02 784949     /lib/ 
libnss_files-2.3.5.so
40235000-40236000 r-xp 00008000 08:02 784949     /lib/ 
libnss_files-2.3.5.so
40236000-40237000 rwxp 00009000 08:02 784949     /lib/ 
libnss_files-2.3.5.so
40237000-40262000 r-xp 00000000 08:02 556975     /usr/local/lib/zsh/ 
4.3.2/zsh/zle.so
40262000-40267000 rwxp 0002a000 08:02 556975     /usr/local/lib/zsh/ 
4.3.2/zsh/zle.so
zsh: 28006 abort (core dumped)  zsh02 556957     /usr/local/lib/z