lval substr() coredumps with refs (with patch)