bug in examples/Expr.hs:subst