syntax check of 'echo $HOME' crashes in ksh emulation mode

[Kamil Dudka <kdudka@xxxxxxxxxx>]

The following command causes a SIGSEGV in zsh (built from upstream git HEAD):

$ ARGV0=ksh zsh -nc 'echo $HOME'
zsh: segmentation fault (core dumped)  ARGV0=ksh Src/zsh -nc 'echo $HOME'

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00000000004a3ded in sepsplit (s=0x0, sep=0x0, allownull=0, heap=1) at utils.c:3495
3495        if (s[0] == Nularg && !s[1])

(gdb) bt
#0  0x00000000004a3ded in sepsplit (s=0x0, sep=0x0, allownull=0, heap=1) at utils.c:3495
#1  0x0000000000497927 in paramsubst (l=0x7f63e07981a8, n=0x7f63e07981d8, str=0x7ffc3c5300f0, qt=0, pf_flags=16) at subst.c:3375
#2  0x0000000000490d4b in stringsubst (list=0x7f63e07981a8, node=0x7f63e07981d8, pf_flags=16, asssub=0) at subst.c:236
#3  0x0000000000490361 in prefork (list=0x7f63e07981a8, flags=0) at subst.c:77
#4  0x000000000042ed4e in execcmd (state=0x7ffc3c530bd0, input=0, output=0, how=18, last1=1) at exec.c:2724
#5  0x000000000042c391 in execpline2 (state=0x7ffc3c530bd0, pcode=131, how=18, input=0, output=0, last1=1) at exec.c:1748
#6  0x000000000042b2d0 in execpline (state=0x7ffc3c530bd0, slcode=4098, how=18, last1=1) at exec.c:1526
#7  0x000000000042a704 in execlist (state=0x7ffc3c530bd0, dont_change_job=0, exiting=1) at exec.c:1284
#8  0x0000000000429f4d in execode (p=0x7f63e0798130, dont_change_job=0, exiting=1, context=0x4b10e1 "cmdarg") at exec.c:1075
#9  0x0000000000429e24 in execstring (s=0x7ffc3c532223 "echo $HOME", dont_change_job=0, exiting=1, context=0x4b10e1 "cmdarg") at exec.c:1041
#10 0x000000000044dc73 in init_misc () at init.c:1281
#11 0x000000000044edf3 in zsh_main (argc=3, argv=0x7ffc3c530da8) at init.c:1664
#12 0x000000000040f296 in main (argc=3, argv=0x7ffc3c530da8) at ./main.c:93