bool VerifyScript(const CScript& scriptSig, const CScript& scriptPubKey, const CTransaction& txTo, unsigned int nIn,
unsigned int flags, int nHashType)
{
vector > stack, stackCopy;
if (!EvalScript(stack, scriptSig, txTo, nIn, flags, nHashType))
return false;
if (flags & SCRIPT_VERIFY_P2SH)
stackCopy = stack;
if (!EvalScript(stack, scriptPubKey, txTo, nIn, flags, nHashType))
return false;
Evaluating
scriptSig and
scriptPubKey deal with the same stack (of course, the first one is pushing, second is checking)
But they use local altStack for calculations!!!
So, it is impossible to push value with scriptSig to altStack and pop it later when processing scriptPubKey.
This output is unspendable. Coins lost.