string_cat(): guard SCM vars more carefully