[This should be for v1.0.30, but that is not currently an option]

Below is a reduced testcase of what I was trying to accomplish with 
<func:result/>:

<?xml version="1.0"?>

<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:exsl="http://exslt.org/common"
xmlns:func="http://exslt.org/functions"
xmlns:my="http://www.xontech.com/functions"
               extension-element-prefixes="func">
       <func:function name="my:check">
               <xsl:variable name="test">
                       <node/>
               </xsl:variable>
               <xsl:variable name="test-node" select="exsl:node-set
($test)/*"/>
               <func:result select="$test-node"/>
       </func:function>
       <xsl:template match="/">
               <xsl:copy-of select="my:check()"/>
       </xsl:template>
</xsl:stylesheet>

I ran it with 'xsltproc test.xslt test.xslt' and the result is a very 
strange element name and namespace that appear to come from invalid memory 
reads.

Using libxml 20507, libxslt 10030 and libexslt 720
xsltproc was compiled against libxml 20507, libxslt 10030 and libexslt 720
libxslt 10030 was compiled against libxml 20507
libexslt 720 was compiled against libxml 20507

In an attempt to further reduce the testcase, I just noticed the removing 
the extra step with the second <xsl:variable/> in my:check() seems to work 
fine (i.e. <func:result select="exsl:node-set($test)/*"/>).