Fix incorrect freeing of expansions

Freeing an expansion should free its children, not its siblings...
Fixes a use-after-free reported by scan-build. Nice catch!

src/asm/lexer.c

@@ -553,13 +553,16 @@ static void beginExpansion(size_t distance, uint8_t skip,
 
 static void freeExpansion(struct Expansion *expansion)
 {
-	do {
+	struct Expansion *child = expansion->firstChild;
-		struct Expansion *next = expansion->next;
 
+	while (child) {
+		struct Expansion *next = child->next;
+
+		freeExpansion(child);
+		child = next;
+	}
 	free(expansion->name);
 	free(expansion);
-		expansion = next;
-	} while (expansion);
 }
 
 /* If at any point we need more than 255 characters of lookahead, something went VERY wrong. */