diff --git a/src/regexp.c b/src/regexp.c
index d431932..147452a 100644
--- a/src/regexp.c
+++ b/src/regexp.c
@@ -620,6 +620,7 @@
 {
     magic_T	mymagic;
     char_u	*p = startp;
+    size_t	startplen = STRLEN(startp);
 
     if (magic)
 	mymagic = MAGIC_ON;
@@ -642,12 +643,9 @@
 	{
 	    if (dirc == '?' && newp != NULL && p[1] == '?')
 	    {
-		size_t	startplen = 0;
-
 		// change "\?" to "?", make a copy first.
 		if (*newp == NULL)
 		{
-		    startplen = STRLEN(startp);
 		    *newp = vim_strnsave(startp, startplen);
 		    if (*newp != NULL)
 			p = *newp + (p - startp);
diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
index cf2c73f..a2367cd 100644
--- a/src/testdir/test_substitute.vim
+++ b/src/testdir/test_substitute.vim
@@ -173,6 +173,16 @@
   call feedkeys("Qsc\<CR>y", 'tx')
   bwipe!
 endfunc
+
+" Test :s with ? as separator.
+func Test_substitute_question_separator()
+  new
+  call setline(1, '??:??')
+  %s?\?\??!!?g
+  call assert_equal('!!:!!', getline(1))
+  bwipe!
+endfunc
+
 " Test %s/\n// which is implemented as a special case to use a
 " more efficient join rather than doing a regular substitution.
 func Test_substitute_join()
diff --git a/src/version.c b/src/version.c
index de9afee..98ec475 100644
--- a/src/version.c
+++ b/src/version.c
@@ -705,6 +705,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    436,
+/**/
     435,
 /**/
     434,