I never quite proved that. In theory it was only accessed here while some executor was processing and each executor set it before p_execute, so there should never have been a problem. But I reorganized the code to explicitly unset the replacement variable (that now just points to the executor instead of to a string in the middle of the executor) when the Proxy goes out of scope at the end of p_execute. It's safer and it seems to work now, but I never figured out why/when/how the old "riskier" code actually failed. I could understand the executor and its string being destructed if the fragment was de-cached, leaving this bad string pointer behind, but I couldn't figure out how we could reach this point of dereferencing the pointer before it was made safe again by resetting it to a new executor's string.