pbx.c: put copy of ast_exten.data on stack to prevent memory corruption

During dialplan execution in pbx_extension_helper(), the contexts global
read lock prevents link list corruption, but was released with a pointer
to the ast_exten and data later used in variable substitution.  Instead,
this patch removes pbx_substitute_variables() and locates a copy of the
ast_exten data on the stack before releasing the lock, where ast_exten
could get free'd by another thread performing a module reload.

(issue AST-1179)
Reported by: Thomas Arimont
(issue AST-1246)
Reported by: Alexander Hömig
Review: https://reviewboard.asterisk.org/r/3055/
........

Merged revisions 403862 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 403863 from http://svn.asterisk.org/svn/asterisk/branches/11
........

Merged revisions 403864 from http://svn.asterisk.org/svn/asterisk/branches/12


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@403865 65c4cc65-6c06-0410-ace0-fbb531ad65f3