pbx.c: prevent potential crash from recursive replace()

Recurisve usage of replace() resulted in corruption of the
temporary string storage and potential crash.  By changing
the string to be allocated separtely per instance, this is
eliminated.

ASTERISK-23650 #comment Reported by: Roel van Meer
ASTEIRSK-23650 #close

Review: https://reviewboard.asterisk.org/r/3539/



git-svn-id: http://svn.asterisk.org/svn/asterisk/branches/1.8@414214 f38db490-d61c-443f-a65b-d21fe96a405b