In expand_deps() [file.c], we do:

char *p;
...
p = variable_expand ("");
variable_buffer_output (p, d->name, strlen (d->name) + 1);

and then use p as if it was pointing to the beginning of the variable buffer (aka variable_buffer).
For a large enough string (16KB will do), variable_buffer_output() will reallocate the variable buffer, leaving p pointing to dark places.
What we should be doing following the variable_buffer_output() call is:
p = variable_buffer;

Subsequently, we do:
char *buffer = variable_expand ("");
o = subst_expand (buffer, d->name, "%", "$*", 1, 2, 0);
d->name = strcache_add_len (buffer, o - buffer);

Again, assuming 'buffer' represents the beginning of the variable buffer.
We should rather write:
d->name = strcache_add_len (o, o - variable_buffer);