References could leak, NULL could be dereferenced, and the Expat parser could
be double freed when some errors raised.