zsh heap-use-after-free

gistfile1.txt

$ ./zsh -c 'a="a=n++";((a))'

=================================================================
==13566==ERROR: AddressSanitizer: heap-use-after-free on address 0xb61056d5 at pc 0x08205bb8 bp 0xbfffe1c8 sp 0xbfffe1bc
READ of size 1 at 0xb61056d5 thread T0
    #0 0x8205bb7 in matheval (/root/fuzzshell/zsh+0x8205bb7)
    #1 0x8270cd4 in getnumvalue (/root/fuzzshell/zsh+0x8270cd4)
    #2 0x82050ca  (/root/fuzzshell/zsh+0x82050ca)
    #3 0x82059f0 in matheval (/root/fuzzshell/zsh+0x82059f0)
    #4 0x80c9ca8  (/root/fuzzshell/zsh+0x80c9ca8)
    #5 0x811ce77  (/root/fuzzshell/zsh+0x811ce77)
    #6 0x810c7fd in execlist (/root/fuzzshell/zsh+0x810c7fd)
    #7 0x810de38 in execode (/root/fuzzshell/zsh+0x810de38)
    #8 0x810e4fe in execstring (/root/fuzzshell/zsh+0x810e4fe)
    #9 0x819c9d4 in init_misc (/root/fuzzshell/zsh+0x819c9d4)
    #10 0x81a4577 in zsh_main (/root/fuzzshell/zsh+0x81a4577)
    #11 0x805a83a in main (/root/fuzzshell/zsh+0x805a83a)
    #12 0xb781270d in __libc_start_main (/lib/i386-linux-gnu/i686/cmov/libc.so.6+0x1870d)
    #13 0x805b23b  (/root/fuzzshell/zsh+0x805b23b)