Crash when evaluating $a$#

```
$ echo $a$#
../ast.c:1051:41: runtime error: null pointer passed as argument 1, which is declared to never be null
AddressSanitizer:DEADLYSIGNAL
=================================================================
==626812==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fbd9c4f679a bp 0x7ffe99e565f0 sp 0x7ffe99e55d68 T0)
==626812==The signal is caused by a READ memory access.
==626812==Hint: address points to the zero page.
#0 0x7fbd9c4f6799 in __strlen_sse2 (/usr/lib/libc.so.6+0x9e799)
#1 0x7fbd9d25f712 in __interceptor_strdup /build/gcc/src/gcc/libsanitizer/asan/asan_interceptors.cc:441
#2 0x7fbd9d08a6c6 in mrsh_word_copy ../ast.c:1051
#3 0x7fbd9d08abdd in mrsh_word_copy ../ast.c:1070
#4 0x7fbd9d08c098 in mrsh_command_copy ../ast.c:1142
#5 0x7fbd9d08e091 in mrsh_and_or_list_copy ../ast.c:1253
#6 0x7fbd9d08a004 in mrsh_node_copy ../ast.c:1022
#7 0x7fbd9d0c50f5 in job_create ../shell/job.c:84
#8 0x7fbd9d0ce433 in run_pipeline ../shell/task/pipeline.c:30
#9 0x7fbd9d0d639e in run_and_or_list ../shell/task/task.c:291
#10 0x7fbd9d0d7128 in run_command_list_array ../shell/task/task.c:375
#11 0x7fbd9d0d7aba in mrsh_run_program ../shell/task/task.c:432
#12 0x564d93ec0966 in main ../main.c:131
#13 0x7fbd9c47f152 in __libc_start_main (/usr/lib/libc.so.6+0x27152)
#14 0x564d93ebf4bd in _start (/home/simon/src/mrsh/build/mrsh+0x44bd)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/usr/lib/libc.so.6+0x9e799) in __strlen_sse2
==626812==ABORTING
```

Start by reproducing `echo $a$#` under AddressSanitizer, then inspect `ast.c` around line 1051 and the copy path shown in the trace through `shell/job.c`. Trace how this input reaches `mrsh_word_copy`; done means the command no longer crashes or triggers the reported null-pointer error.

Written by the indexing model from the issue text.