The reader has an extra 1-char unread buffer that was incorrectly
initialised to 0, which means that the first character read would
always be NUL. As this is often the code that looks for the
lexical-binding cookie, the first loaded source module would be
treated as dynamically bound. During bootstrapping this is loadup.el
and so its local variables got dumped into the global environment.
* src/lread.c (unread_char): Initialise to empty.
(Fload): Initialise here too just in case.