This ASSERT failure (in substTy) was reported in Trac #14024.

This patch gets the in-scope set right.

(Does not fix tests T13822 or T13594.)