Fix bug #61681: Malformed grammar

Generate T_STRING_VARNAME only if it actually is one. This is only the case
for "${varname}" and "${varname[offset]}" so we can just add a check for
} or [ after the LABEL.

Author: nikic

NEWS

@@ -10,6 +10,7 @@ PHP                                                                        NEWS
 - Core:
   . Implemented FR #60738 (Allow 'set_error_handler' to handle NULL).
     (Laruence, Nikita Popov)
+  . Fixed bug #61681 (Malformed grammar). (Nikita Popov, Etienne, Laruence).
 
 - cURL:
   . Added support for CURLOPT_FTP_RESPONSE_TIMEOUT, CURLOPT_APPEND, 

Zend/tests/bug61681.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Bug #61681: Malformed grammar
+--FILE--
+<?php
+$la = "ooxx";
+
+echo "${substr('laruence', 0, 2)}"; 
+
+?>
+--EXPECT--
+ooxx