hush: fix segfault in ${?:N:M}

function                                             old     new   delta
expand_vars_to_list                                 2374    2409     +35
builtin_umask                                        132     133      +1
builtin_exit                                          47      48      +1
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 3/0 up/down: 37/0)               Total: 37 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

shell/hush_test/hush-vars/param_expand_bash_substring.right

@@ -39,6 +39,19 @@ f:1:2=|12|
 f::2 =|01|
 f:1: =||
 f::  =||
+Substrings from special vars
+?    =|0|
+?:1  =||
+?:1:2=||
+?::2 =|0|
+?:1: =||
+?::  =||
+#    =|11|
+#:1  =|1|
+#:1:2=|1|
+#::2 =|11|
+#:1: =||
+#::  =||
 Substrings with expressions
 f            =|01234567|
 f:1+1:2+2    =|2345|