diff --git a/7.2.016 b/7.2.016
new file mode 100644
index 0000000..03d5207
--- /dev/null
+++ b/7.2.016
@@ -0,0 +1,166 @@
+To: vim-dev@vim.org
+Subject: Patch 7.2.016
+Fcc: outbox
+From: Bram Moolenaar <Bram@moolenaar.net>
+Mime-Version: 1.0
+Content-Type: text/plain; charset=ISO-8859-1
+Content-Transfer-Encoding: 8bit
+------------
+
+Patch 7.2.016
+Problem:    The pattern being completed may be in freed memory when the
+	    command line is being reallocated. (Dominique Pelle)
+Solution:   Keep a pointer to the expand_T in the command line structure.
+	    Don't use <S-Tab> as CTRL-P when there are no results.  Clear the
+	    completion when using a command line from the history.
+Files:	    src/ex_getln.c
+
+
+*** ../vim-7.2.015/src/ex_getln.c	Fri Aug  8 12:58:59 2008
+--- src/ex_getln.c	Wed Sep 10 22:43:41 2008
+***************
+*** 31,36 ****
+--- 31,38 ----
+      int		cmdattr;	/* attributes for prompt */
+      int		overstrike;	/* Typing mode on the command line.  Shared by
+  				   getcmdline() and put_on_cmdline(). */
++     expand_T	*xpc;		/* struct being used for expansion, xp_pattern
++ 				   may point into cmdbuff */
+      int		xp_context;	/* type of expansion */
+  # ifdef FEAT_EVAL
+      char_u	*xp_arg;	/* user-defined expansion arg */
+***************
+*** 38,44 ****
+  # endif
+  };
+  
+! static struct cmdline_info ccline;	/* current cmdline_info */
+  
+  static int	cmd_showtail;		/* Only show path tail in lists ? */
+  
+--- 40,50 ----
+  # endif
+  };
+  
+! /* The current cmdline_info.  It is initialized in getcmdline() and after that
+!  * used by other functions.  When invoking getcmdline() recursively it needs
+!  * to be saved with save_cmdline() and restored with restore_cmdline().
+!  * TODO: make it local to getcmdline() and pass it around. */
+! static struct cmdline_info ccline;
+  
+  static int	cmd_showtail;		/* Only show path tail in lists ? */
+  
+***************
+*** 238,243 ****
+--- 244,250 ----
+      }
+  
+      ExpandInit(&xpc);
++     ccline.xpc = &xpc;
+  
+  #ifdef FEAT_RIGHTLEFT
+      if (curwin->w_p_rl && *curwin->w_p_rlc == 's'
+***************
+*** 408,416 ****
+  #endif
+  
+  	/*
+! 	 * <S-Tab> works like CTRL-P (unless 'wc' is <S-Tab>).
+  	 */
+! 	if (c != p_wc && c == K_S_TAB && xpc.xp_numfiles != -1)
+  	    c = Ctrl_P;
+  
+  #ifdef FEAT_WILDMENU
+--- 415,424 ----
+  #endif
+  
+  	/*
+! 	 * When there are matching completions to select <S-Tab> works like
+! 	 * CTRL-P (unless 'wc' is <S-Tab>).
+  	 */
+! 	if (c != p_wc && c == K_S_TAB && xpc.xp_numfiles > 0)
+  	    c = Ctrl_P;
+  
+  #ifdef FEAT_WILDMENU
+***************
+*** 1513,1518 ****
+--- 1521,1527 ----
+  		    int		old_firstc;
+  
+  		    vim_free(ccline.cmdbuff);
++ 		    xpc.xp_context = EXPAND_NOTHING;
+  		    if (hiscnt == hislen)
+  			p = lookfor;	/* back to the old one */
+  		    else
+***************
+*** 1839,1844 ****
+--- 1848,1854 ----
+  #endif
+  
+      ExpandCleanup(&xpc);
++     ccline.xpc = NULL;
+  
+  #ifdef FEAT_SEARCH_EXTRA
+      if (did_incsearch)
+***************
+*** 2508,2513 ****
+--- 2518,2537 ----
+      }
+      mch_memmove(ccline.cmdbuff, p, (size_t)ccline.cmdlen + 1);
+      vim_free(p);
++ 
++     if (ccline.xpc != NULL
++ 	    && ccline.xpc->xp_pattern != NULL
++ 	    && ccline.xpc->xp_context != EXPAND_NOTHING
++ 	    && ccline.xpc->xp_context != EXPAND_UNSUCCESSFUL)
++     {
++ 	int i = ccline.xpc->xp_pattern - p;
++ 
++ 	/* If xp_pattern points inside the old cmdbuff it needs to be adjusted
++ 	 * to point into the newly allocated memory. */
++ 	if (i >= 0 && i <= ccline.cmdlen)
++ 	    ccline.xpc->xp_pattern = ccline.cmdbuff + i;
++     }
++ 
+      return OK;
+  }
+  
+***************
+*** 2875,2880 ****
+--- 2899,2905 ----
+      prev_ccline = ccline;
+      ccline.cmdbuff = NULL;
+      ccline.cmdprompt = NULL;
++     ccline.xpc = NULL;
+  }
+  
+  /*
+***************
+*** 3582,3587 ****
+--- 3607,3613 ----
+  ExpandInit(xp)
+      expand_T	*xp;
+  {
++     xp->xp_pattern = NULL;
+      xp->xp_backslash = XP_BS_NONE;
+  #ifndef BACKSLASH_IN_FILENAME
+      xp->xp_shell = FALSE;
+*** ../vim-7.2.015/src/version.c	Wed Sep 10 18:25:18 2008
+--- src/version.c	Sun Sep 14 14:38:47 2008
+***************
+*** 678,679 ****
+--- 678,681 ----
+  {   /* Add new patch number below this line */
++ /**/
++     16,
+  /**/
+
+-- 
+hundred-and-one symptoms of being an internet addict:
+53. To find out what time it is, you send yourself an e-mail and check the
+    "Date:" field.
+
+ /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
+///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
+\\\        download, build and distribute -- http://www.A-A-P.org        ///
+ \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///