Fix a bug when shell expansion is done against dangling symlinks, by

converting the stat() call to a lstat() call, which will cover the
situation.  One can exercise this bug by referring a dangling link with
something like */the-link.

Approved by:	re (scottl)
Submitted by:	Simon 'corecode' Schubert [corecode fs ei tum de]
Obtained from:	NetBSD via DragonFlyBSD (NetBSD rev. 1.51 and DragonFly
		rev. 1.6)
MFC After:	3 days

bin/sh/expand.c

@@ -1162,7 +1162,7 @@ expmeta(char *enddir, char *name)
 			if (*p == '\0')
 				break;
 		}
-		if (metaflag == 0 || stat(expdir, &statb) >= 0)
+		if (metaflag == 0 || lstat(expdir, &statb) >= 0)
 			addfname(expdir);
 		return;
 	}