From OpenBSD:

2009-06-01 20:20  deraadt

        * expr.c (1.20): "let --" was crashing ksh; found by
          phy0@rambler.ru.  Various other expressions involving ++ and --
          also ran into this. Insufficient checks for end of parse in the
          tokenizer made it assume that an lvalue had been found ok millert
          otto

Index: pdksh-5.2.14/expr.c
===================================================================
--- pdksh-5.2.14.orig/expr.c	2009-09-19 11:22:35.000000000 +0200
+++ pdksh-5.2.14/expr.c	2009-09-19 12:07:08.000000000 +0200
@@ -558,7 +558,8 @@
 	enum token op;
 	struct tbl *vasn;
 {
-	if (vasn->name[0] == '\0' && !(vasn->flag & EXPRLVALUE))
+	if (es->tok == END ||
+	    (vasn->name[0] == '\0' && !(vasn->flag & EXPRLVALUE)))
 		evalerr(es, ET_LVALUE, opinfo[(int) op].name);
 	else if (vasn->flag & RDONLY)
 		evalerr(es, ET_RDONLY, opinfo[(int) op].name);
Index: pdksh-5.2.14/tests/debian-114.t
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ pdksh-5.2.14/tests/debian-114.t	2009-09-19 12:11:08.000000000 +0200
@@ -0,0 +1,8 @@
+name: debian-114-1
+description:
+	Check if let crashes
+stdin:
+	let --
+	exit 0
+expected-stderr-pattern: /\-\- requires lvalue/
+---