diff --git a/Android.mk b/Android.mk
index 48a6867..2d572bd 100644
--- a/Android.mk
+++ b/Android.mk
@@ -79,6 +79,6 @@
     -DHAVE_SETGROUPS=1 -DHAVE_STRERROR=1 -DHAVE_STRSIGNAL=0 \
     -DHAVE_STRLCPY=1 -DHAVE_FLOCK_DECL=1 -DHAVE_REVOKE_DECL=1 \
     -DHAVE_SYS_ERRLIST_DECL=0 -DHAVE_SYS_SIGLIST_DECL=1 \
-    -DHAVE_PERSISTENT_HISTORY=0 -DMKSH_BUILD_R=503
+    -DHAVE_PERSISTENT_HISTORY=0 -DMKSH_BUILD_R=504
 
 include $(BUILD_EXECUTABLE)
diff --git a/src/Build.sh b/src/Build.sh
index ce6c127..c59163b 100644
--- a/src/Build.sh
+++ b/src/Build.sh
@@ -1,5 +1,5 @@
 #!/bin/sh
-srcversion='$MirOS: src/bin/mksh/Build.sh,v 1.668 2014/10/03 17:32:07 tg Exp $'
+srcversion='$MirOS: src/bin/mksh/Build.sh,v 1.669 2014/10/07 15:22:12 tg Exp $'
 #-
 # Copyright (c) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
 #		2011, 2012, 2013, 2014
@@ -1784,7 +1784,7 @@
 		#define EXTERN
 		#define MKSH_INCLUDES_ONLY
 		#include "sh.h"
-		__RCSID("$MirOS: src/bin/mksh/Build.sh,v 1.668 2014/10/03 17:32:07 tg Exp $");
+		__RCSID("$MirOS: src/bin/mksh/Build.sh,v 1.669 2014/10/07 15:22:12 tg Exp $");
 		int main(void) { printf("Hello, World!\n"); return (isatty(0)); }
 EOF
 	case $cm in
@@ -2316,7 +2316,7 @@
 addsrcs USE_PRINTF_BUILTIN printf.c
 test 1 = "$USE_PRINTF_BUILTIN" && add_cppflags -DMKSH_PRINTF_BUILTIN
 test 1 = "$HAVE_CAN_VERB" && CFLAGS="$CFLAGS -verbose"
-add_cppflags -DMKSH_BUILD_R=503
+add_cppflags -DMKSH_BUILD_R=504
 
 $e $bi$me: Finished configuration testing, now producing output.$ao
 
diff --git a/src/check.t b/src/check.t
index 9c86afd..2e1d032 100644
--- a/src/check.t
+++ b/src/check.t
Binary files differ
diff --git a/src/eval.c b/src/eval.c
index 3bf183c..49a4c33 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -23,7 +23,7 @@
 
 #include "sh.h"
 
-__RCSID("$MirOS: src/bin/mksh/eval.c,v 1.152 2014/10/03 17:32:11 tg Exp $");
+__RCSID("$MirOS: src/bin/mksh/eval.c,v 1.153 2014/10/07 15:22:16 tg Exp $");
 
 /*
  * string expansion
@@ -62,6 +62,7 @@
 #define IFS_WORD	0	/* word has chars (or quotes) */
 #define IFS_WS		1	/* have seen IFS white-space */
 #define IFS_NWS		2	/* have seen IFS non-white-space */
+#define IFS_IWS		3	/* begin of word, ignore IFS WS */
 
 static int varsub(Expand *, const char *, const char *, int *, int *);
 static int comsub(Expand *, const char *, int);
@@ -663,7 +664,7 @@
 						f |= DOTEMP;
 						/* FALLTHROUGH */
 					default:
-						word = IFS_WORD;
+						word = quote ? IFS_WORD : IFS_IWS;
 						/* Enable tilde expansion */
 						tilde_ok = 1;
 						f |= DOTILDE;
@@ -907,12 +908,12 @@
 			 *	IFS_WORD		w/WS	w/NWS	w
 			 *	IFS_WS			-/WS	-/NWS	-
 			 *	IFS_NWS			-/NWS	w/NWS	-
+			 *	IFS_IWS			-/WS	w/NWS	-
 			 * (w means generate a word)
-			 * Note that IFS_NWS/0 generates a word (AT&T ksh
-			 * doesn't do this, but POSIX does).
 			 */
-			if (word == IFS_WORD ||
-			    (word == IFS_NWS && c && !ctype(c, C_IFSWS))) {
+			if ((word == IFS_WORD) || (c &&
+			    (word == IFS_IWS || word == IFS_NWS) &&
+			    !ctype(c, C_IFSWS))) {
  emit_word:
 				*dp++ = '\0';
 				cp = Xclose(ds, dp);
diff --git a/src/mksh.1 b/src/mksh.1
index e2657cb..480184e 100644
--- a/src/mksh.1
+++ b/src/mksh.1
@@ -1,4 +1,4 @@
-.\" $MirOS: src/bin/mksh/mksh.1,v 1.343 2014/10/03 12:35:38 tg Exp $
+.\" $MirOS: src/bin/mksh/mksh.1,v 1.344 2014/10/07 15:30:12 tg Exp $
 .\" $OpenBSD: ksh.1,v 1.153 2014/08/17 07:15:41 jmc Exp $
 .\"-
 .\" Copyright © 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,
@@ -74,7 +74,7 @@
 .\" with -mandoc, it might implement .Mx itself, but we want to
 .\" use our own definition. And .Dd must come *first*, always.
 .\"
-.Dd $Mdocdate: October 3 2014 $
+.Dd $Mdocdate: October 7 2014 $
 .\"
 .\" Check which macro package we use, and do other -mdoc setup.
 .\"
@@ -2530,6 +2530,12 @@
 as numeric arguments to the
 .Ic test
 command, and as the value of an assignment to an integer parameter.
+.Em Warning :
+This also affects implicit conversion to integer, for example as done by the
+.Ic let
+command.
+.Em Never
+use unchecked user input, e.g. from the environment, in arithmetics!
 .Pp
 Expressions are calculated using signed arithmetic and the
 .Vt mksh_ari_t
diff --git a/src/sh.h b/src/sh.h
index 38f849b..b3d1c0b 100644
--- a/src/sh.h
+++ b/src/sh.h
@@ -169,9 +169,9 @@
 #endif
 
 #ifdef EXTERN
-__RCSID("$MirOS: src/bin/mksh/sh.h,v 1.695 2014/10/03 17:32:12 tg Exp $");
+__RCSID("$MirOS: src/bin/mksh/sh.h,v 1.697 2014/10/07 15:22:17 tg Exp $");
 #endif
-#define MKSH_VERSION "R50 2014/10/03"
+#define MKSH_VERSION "R50 2014/10/07"
 
 /* arithmetic types: C implementation */
 #if !HAVE_CAN_INTTYPES
@@ -533,7 +533,7 @@
 #define mkssert(e)	do { } while (/* CONSTCOND */ 0)
 #endif
 
-#if (!defined(MKSH_BUILDMAKEFILE4BSD) && !defined(MKSH_BUILDSH)) || (MKSH_BUILD_R != 503)
+#if (!defined(MKSH_BUILDMAKEFILE4BSD) && !defined(MKSH_BUILDSH)) || (MKSH_BUILD_R != 504)
 #error Must run Build.sh to compile this.
 extern void thiswillneverbedefinedIhope(void);
 int
diff --git a/src/var.c b/src/var.c
index 9785f22..9f05ec1 100644
--- a/src/var.c
+++ b/src/var.c
@@ -28,7 +28,7 @@
 #include <sys/sysctl.h>
 #endif
 
-__RCSID("$MirOS: src/bin/mksh/var.c,v 1.182 2014/10/03 17:20:03 tg Exp $");
+__RCSID("$MirOS: src/bin/mksh/var.c,v 1.183 2014/10/04 11:47:19 tg Exp $");
 
 /*-
  * Variables
@@ -784,8 +784,9 @@
 		/* find value if variable already exists */
 		if ((qval = val) == NULL) {
 			varsearch(e->loc, &vp, tvar, hash(tvar));
-			if (vp != NULL)
-				qval = str_val(vp);
+			if (vp == NULL)
+				goto nameref_empty;
+			qval = str_val(vp);
 		}
 		/* check target value for being a valid variable name */
 		ccp = skip_varname(qval, false);
@@ -803,6 +804,7 @@
 			case '-':
 				goto nameref_rhs_checked;
 			}
+ nameref_empty:
 			errorf("%s: %s", var, "empty nameref target");
 		}
 		len = (*ccp == '[') ? array_ref_len(ccp) : 0;