example command taken from autoconf with set -x enabled:
expr 'x--trace=AC_CONFIG_HEADERS:$n::${::}%' : 'x--[^=]*=\(.*\)' \| 'x--trace=AC_CONFIG_HEADERS:$n::${::}%' : 'x-.\(.*\)'
With other expr implementations, this outputs AC_CONFIG_HEADERS:$n::${::}%, while with toybox this outputs something wrong and different each time like @S{1U
This doesn't occur when the line if (TT.refree) free(TT.refree); in expr.c is removed, not to suggest that simply removing the line is the solution, because that does cause a leak, but just that it's where the problem is.
EDIT: I just noticed there are 2 instances of that line in the file, I was talking about the first one.