The issue is seen every time when the defined variable ("$interface" in the bug
report) is the same as one of the built-in jail.conf parameters excluding the
leading "$". The crash is a use-after-free as variable data is free-ed at a
point but referenced later from intparams.
Having a variable with the same name as a built-in one is problematic anyways
-- the fix eliminates the crash and treats such entries as pure variables as
expected by the leading "$". This is also according to the jail.conf
description that says that "variables are only used for substitution, while
parameters are used both for substitution and for passing to the kernel."