Line 6954 of subst.c, in the setifs function:

  if (!ifs_value)
    {
      ifs_firstc[0] = '\0';
      ifs_firstc_len = 1;
    }
  else
    {
      size_t ifs_len = strnlen (ifs_value, MB_CUR_MAX);
      ifs_firstc_len = mblen (ifs_value, ifs_len);
      memcpy (ifs_firstc, ifs_value, ifs_firstc_len);
    }

If the ifs_value string is not a valid multibyte string, mblen may return -1.
The subsequent memcpy causes a crash.

I'm not sure what the right outcome is, but crashing is not it :)