REG_EXPAND_SZ values referencing variables from a later registry hive
(e.g. TEMP referencing USERPROFILE stored in Volatile Environment) kept
literal %VAR% text, so shells auto-created a %USERPROFILE% folder in the
working directory. Fall back to the process environment when the
referenced variable is not loaded yet, and add a regression test using
the real USERPROFILE so it passes on any machine.
