Self-contained testcase:

character*5, pointer :: p
character*5, target :: c,e

c = "Hallo"
p => c
call s(p,c,p)
print *,p
contains
subroutine s(p,e,d)
character*5, pointer ::p
character*5 :: e, d
e = d
p=>c
end subroutine s
end

gives:
[tobi@marktplatz tests]$ gfortran assign.f90
assign.f90: In function `s':
assign.f90:13: internal compiler error: in gfc_build_indirect_ref, at
fortran/trans.c:296
Please submit a full bug report,
with preprocessed source if appropriate.
See <URL:http://gcc.gnu.org/bugs.html> for instructions.

well, that wasn't a function ... second try:
character*5, pointer :: p
character*5, target :: c,e

c = "Hallo"
p => c
c = s(c,p)
print *,p
contains
function s(e,d)
character*5, pointer ::s
character*5 :: e, d
e = d
s=>c
end function s
end

gives:
[tobi@marktplatz tests]$ gfortran assign.f90
assign.f90: In function `s':
assign.f90:13: internal compiler error: in gfc_build_indirect_ref, at
fortran/trans.c:296
Please submit a full bug report,
with preprocessed source if appropriate.
See <URL:http://gcc.gnu.org/bugs.html> for instructions.
[tobi@marktplatz tests]$

Confirmed.

It compiles, but I doubt it returns the right answer:

toon@book:~/g95-bugs$ /usr/snp/bin/gfortran -static 17192.f90
toon@book:~/g95-bugs$ ./a.out
 мяш

This is on powerpc-unknown-linux-gnu, using gcc-3.5-20040907.

It does still compile, but does still not return the right answer. The problem
disappears if "integer" is used instead of "character*5". The tree dump
(obtained with -fdump-tree-original) is:

s (__result, .__result, e, d, _e, _d)
{
  _gfortran_copy_string (5, e, 5, d);
  __result = (char[1:5] * &) &c;

MAIN__ ()
{
  char c[1:5];
  char[1:5] * p;
  static void s (char[1:5] * &, int4, char[1:5] &, char[1:5] &, int4, int4);

  _gfortran_copy_string (5, &c, 5, "Hallo");
  p = (char[1:5] *) &c;
  {
    char str.0[5];

    s ((char[1:5] *) &str.0, 5, &c, p, 5, 5);
    _gfortran_copy_string (5, &c, 5, (char[1:5] *) &str.0);
  }
 /* ...snip... call output routines */
}

Subject: Bug 17192

CVSROOT:	/cvs/gcc
Module name:	gcc
Changes by:	pault@gcc.gnu.org	2005-05-29 16:02:11

Modified files:
	gcc/fortran    : trans-array.c trans-expr.c 

Log message:
	2005-05-29 Paul Thomas  <pault@gcc.gnu.org>
	
	PR fortran/16939
	PR fortran/17192
	PR fortran/17193
	PR fortran/17202
	PR fortran/18689
	PR fortran/18890
	PR fortran/21297
	* fortran/trans-array.c (gfc_conv_resolve_dependencies): Add string
	length to temp_ss for character pointer array assignments.
	* fortran/trans-expr.c (gfc_conv_variable): Correct errors in
	dereferencing of characters and character pointers.
	* fortran/trans-expr.c (gfc_conv_function_call): Provide string
	length as return argument for various kinds of handling of return.
	Return a char[]* temporary for character pointer functions and
	dereference the temporary upon return.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/fortran/trans-array.c.diff?cvsroot=gcc&r1=1.45&r2=1.46
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/fortran/trans-expr.c.diff?cvsroot=gcc&r1=1.44&r2=1.45

Subject: Bug 17192

CVSROOT:	/cvs/gcc
Module name:	gcc
Branch: 	gcc-4_0-branch
Changes by:	pault@gcc.gnu.org	2005-06-05 08:59:18

Modified files:
	gcc/fortran    : ChangeLog trans-array.c trans-expr.c 

Log message:
	005-05-31  Paul Thomas  <pault@gcc.gnu.org>
	
	PR fortran/18109
	PR fortran/18283
	PR fortran/19107
	PR fortran/16939
	PR fortran/17192
	PR fortran/17193
	PR fortran/17202
	PR fortran/18689
	PR fortran/18890
	* fortran/trans-array.c (gfc_conv_expr_descriptor): Obtain the
	string length from the expression typespec character length value
	and set temp_ss->stringlength and backend_decl. Obtain the
	tree expression from gfc_conv_expr rather than gfc_conv_expr_val.
	Dereference the expression to obtain the character.
	* fortran/trans-array.c (gfc_conv_resolve_dependencies): Add string
	length to temp_ss for character pointer array assignments.
	* fortran/trans-expr.c (gfc_conv_component_ref): Remove the
	dereference of scalar character pointer structure components.
	* fortran/trans-expr.c (gfc_trans_subarray_assign): Obtain the
	string length for the structure component from the component
	expression.
	* fortran/trans-expr.c (gfc_conv_variable): Correct errors in
	dereferencing of characters and character pointers.
	* fortran/trans-expr.c (gfc_conv_function_call): Provide string
	length as return argument for various kinds of handling of return.
	Return a char[]* temporary for character pointer functions and
	dereference the temporary upon return.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/fortran/ChangeLog.diff?cvsroot=gcc&only_with_tag=gcc-4_0-branch&r1=1.335.2.66&r2=1.335.2.67
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/fortran/trans-array.c.diff?cvsroot=gcc&only_with_tag=gcc-4_0-branch&r1=1.39.2.3&r2=1.39.2.4
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/fortran/trans-expr.c.diff?cvsroot=gcc&only_with_tag=gcc-4_0-branch&r1=1.38.2.4&r2=1.38.2.5

Fixed in 4.0 and 4.1