[xslt] str:replace with empty replacement element crashes

[Ron Burk <ronburk hightechinfo com>]

Crashed on both a Windows and Linux copy of xsltproc.

Putting a call to string() around the final argument of
str:replace() creates correct behavior, so I assume the
bug is in str:replace(). I couldn't seem to figure out where
the source to libexslt actually resides, so this is as far
as I got.

=============================================
Using libxml 20702, libxslt 10124 and libexslt 813
xsltproc was compiled against libxml 20632, libxslt 10123 and libexslt 813
libxslt 10124 was compiled against libxml 20701
libexslt 813 was compiled against libxml 20701
==============================================

The problem can be seen by applying the following stylesheet
to any XML document:

<?xml version="1.0"?>
<xsl:stylesheet
xmlns:xsl="http://www.w3.org/1999/XSL/Transform";
xmlns:exsl="http://exslt.org/common";
xmlns:str="http://exslt.org/strings";
extension-element-prefixes="exsl"
version="1.1"
>

<xsl:template match="/">
    <xsl:variable name="Formal">
        <param>$1</param>
        <param>$2</param>
        <param>$3</param>
        <param>$4</param>
    </xsl:variable>
    <xsl:variable name="msg">
        <Message>whatever</Message>
        <Arg />
    </xsl:variable>

    <xsl:variable name="Format">'$1' should not have more than $2 '$3' 
children; it has $4</xsl:variable>
    <xsl:value-of 
select="str:replace($Format,exsl:node-set($Formal)/param,exsl:node-set($msg)/Message/Arg)"/>

</xsl:template>

</xsl:stylesheet>