BUGS:

 - lexer doesn't impose limits on identfiers, this could lead
   to buffer overflows.
   So there a bunch of strcats and sprintf's, some of them
   marked XXX, that are unsafe.

