Hello,

I'm not sure whether this is the right place to send a bug report on
l3tl. The following code causes a runaway argument. I didn't look yet
at the implementation, but if needed, I can propose a bug fix some
time this week.

\RequirePackage{expl3}
\ExplSyntaxOn
\tl_new:Nn \g_my_tl {aabono}
\tl_replace_in:Nnn \g_my_tl {bonobo} {whatever}

Basically what happens is that the string we are looking for is put
directly after the `\g_my_tl`, forming `bonobo`. This `bonobo` is
replaced, and then the termination tries to remove the extra
`bonobo\q_stop` which was added. This fails. The only way out is
apparently to use two markers. It has been done a couple of times
before (stringstring, perhaps?), so I just need to hunt for the
reference.

aabono -> aabonobonobo\q_stop -> aawhatevernobo\q_stop -> BOOM!

-- 
Regards,
Bruno Le Floch