Found with the Clang static analyzer.
Index: c_ksh.c =================================================================== RCS file: /cvs/src/bin/ksh/c_ksh.c,v retrieving revision 1.35 diff -u -p -r1.35 c_ksh.c --- c_ksh.c 1 Sep 2015 13:12:31 -0000 1.35 +++ c_ksh.c 7 Sep 2015 03:44:11 -0000 @@ -534,7 +534,7 @@ c_command(char **wp) int c_typeset(char **wp) { - struct block *l = e->loc; + struct block *l; struct tbl *vp, **p; Tflag fset = 0, fclr = 0; int thing = 0, func = 0, local = 0;