updated for version 7.3.1258
Problem:    Using submatch() may crash Vim. (Ingo Karkat)
Solution:   Restore the number of subexpressions used.
diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
index 8146d9d..bd3818d 100644
--- a/src/regexp_nfa.c
+++ b/src/regexp_nfa.c
@@ -5198,6 +5198,8 @@
 			 || t->state->c == NFA_START_INVISIBLE_BEFORE_FIRST
 			 || t->state->c == NFA_START_INVISIBLE_BEFORE_NEG_FIRST)
 		    {
+			int in_use = m->norm.in_use;
+
 			/* Copy submatch info for the recursive call, so that
 			 * \1 can be matched. */
 			copy_sub_off(&m->norm, &t->subs.norm);
@@ -5231,6 +5233,7 @@
 			    add_here = TRUE;
 			    add_state = t->state->out1->out;
 			}
+			m->norm.in_use = in_use;
 		    }
 		    else
 		    {