emit_expr, used by '.word' and others, grabs dot_value for the current
frag, does some processing, and later calls frag_more. Unfortunately,
the frag_more call can realize the frag is not big enough and switch
to a new frag. That's bad because the dot_value already recorded an
offset into the old frag, which is completely wrong for the new frag.
The result is that you can get PC-relative relocations with incorrect
offsets if they happen to span the byte boundary where a frag fills
up. I saw this with a PC-relative relocation at a large odd byte
offset, which is probably the only time this can happen. Unaligned
PC-relative offsets are an unusual case, which is why this probably
hasn't been reported before.