The problem can be seen by running the following script.

$ more ks6f3
#!/bin/ksh
function vlfunc {
  print "begin vlfunc"
  typeset IFS="$IFS"

  while read line
  do
    :
  done < /dev/null
  print "$( vlsub_func )"
  print END
}

function vlsub_func {
  print "begin vlsub_func"
  vlsub_sub_func
  IFS="DEF"
  vlsub_sub_func
  print "end vlsub_func"
  return
}

function vlsub_sub_func {
  print "begin vlsub_sub_func"
  IFS="abc"
  print "end vlsub_sub_func"
}

########################################
# run main, set up clean exit
#
IFS="hold"
vlfunc
vlfunc
vlfunc
[vern@vernsf2 test-ksh]$ ./ks6f3
begin vlfunc
begin vlsub_func
begin vlsub_sub_func
end vlsub_sub_func
begin vlsub_sub_func
end vlsub_sub_func
end vlsub_func
END
begin vlfunc
Segmentation fault (core dumped)
[vern@vernsf2 test-ksh]$

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1647.html