[patch] segfault in sh for bogus redirection

Hey Stefan (and other people familiar with the sh(1) code),

I stumbled on a corner case bug in sh(1) where it segfaults instead of
giving a proper error message.  This only happens when you do
something stupid, but I thought it should be fixed anyway.

When you redirect to an unset or empty variable things fail:

     $ sh -c 'echo 1 >&$a'
     Segmentation fault (core dumped)

With patch:

     $ sh -c 'echo 1 >&$a'
     Syntax error: Bad fd number

I have made a patch which fixes the issue (attached) so it fails
normally with an error, but I'm not sure if it's the right way of
fixing it.  Do you think this fix is OK, or is there a better way to
do this?

I also included a regression test to check for the problem.

-- 
Simon L. Nielsen