It was wrong before, but asymptomatic because it still stashed the 3rd argument in the right spot.  And the opargsym() function would happily walk off the end of the array.

When I simplified some other code by modifying opargsym to return NULL when asked for a symbol beyond the number of args that an op had, that's when this bug popped up.  I made that NULL change in order to fix the other, unrelated, but in 'split.'