--- a/src/callproc.c	Mon Aug 13 08:54:52 2007 +0200
+++ b/src/callproc.c	Mon Aug 13 08:55:10 2007 +0200
@@ -184,6 +184,7 @@
   char *bufptr = buf;
   int bufsize = 16384;
   int speccount = specpdl_depth ();
+  struct gcpro gcpro1;
   char **new_argv
     = (char **) alloca ((max (2, nargs - 2)) * sizeof (char *));
   
@@ -223,8 +224,8 @@
 
     GCPRO2 (current_dir, path);   /* Caller gcprotects args[] */
     current_dir = current_buffer->directory;
-    current_dir = expand_and_dir_to_file
-      (Funhandled_file_name_directory (current_dir), Qnil);
+    current_dir = Funhandled_file_name_directory (current_dir);
+    current_dir = expand_and_dir_to_file (current_dir, Qnil);
 #if 0
   /* I don't know how RMS intends this crock of shit to work, but it
      breaks everything in the presence of ange-ftp-visited files, so
@@ -238,12 +239,17 @@
 
   if (nargs >= 2 && ! NILP (args[1]))
     {
+      struct gcpro gcpro1;
+      GCPRO1 (current_buffer->directory);
       infile = Fexpand_file_name (args[1], current_buffer->directory);
+      UNGCPRO;
       CHECK_STRING (infile);
     }
   else
     infile = build_string (NULL_DEVICE);
 
+  GCPRO1 (infile);		/* Fexpand_file_name might trash it */
+
   if (nargs >= 3)
     {
       buffer = args[2];
@@ -281,6 +287,8 @@
   else 
     buffer = Qnil;
 
+  UNGCPRO;
+
   display = ((nargs >= 4) ? args[3] : Qnil);
 
   /* From here we assume we won't GC (unless an error is signaled). */