> Is that a profile for the entire shell from startup to exit, or just
> for the ${(f)"$(</tmp/blah)"//,/x} substitution?

Entire shell, run as
time obj/Src/zsh -fc 'print -l ${(f)"$(</tmp/blah)"//,/x} >/dev/null'

> Is zsh compiled with debugging (that is, with the DEBUG macro defined)?
> ztrsub() shouldn't be particularly expensive, but it's a bit more so in
> debugging mode.

No, without.

> Also, there's no loop in pattryrefs(), so the fact that it's in ztrsub()
> may be misleading.  There are exactly 2 calls to ztrsub() in there.
> What's calling pattryrefs() 28000+ times?  Is that how many lines there
> are in /tmp/blah?

231 lines, but 57093 chars.  pattrylen() seems to be called 57092 times
by igetmatch.