PmOracle.addVarCoreCt was giving a bogus (empty) in-scope set to
exprIsConApp_maybe, which resulted in a substitution-invariant
failure (see MR !1647 discussion).

This patch fixes it, by taking the free vars of the expression.