Expression.substitute now exploits hash-consing.