Saxon

The function call that fails is in a template that has both a name and a match pattern. For component binding purposes, this is treated as two separate components, with different binding vectors. The expression trees for the two components should be disjoint, so that they can use different binding slot numbers. I suspect that the component hasn't been copied properly and that the two components are sharing some subtree of the expression tree, causing an incorrect slot number to be used.

I was right: the template body contains a LocalParamSetter which contains a reference to a LocalParam. The LocalParam object isn't being copied, which means that the initializer of the LocalParam (written as the content of the xsl:param element but represented on the tree as a select attribute) isn't being copied, so the slot number allocated in its role as a named template gets overwritten by the slot number allocated in its role as a template rule. See LocalParamSetter.copy(), which doesn't copy the "binding" (i.e. the LocalParam).

Copying the LocalParam is tricky because we need to rebind all local variable references to it, throughout the template body. We can only do this once the whole template body has been copied. It's also complicated by the fact that the LocalParamSetter is used not only for initialization of template parameters, but also for the initialization of xsl:iterate parameters.