diff --git a/src/version.c b/src/version.c
index f1534f1284..4e6435c31d 100644
--- a/src/version.c
+++ b/src/version.c
@@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2736,
 /**/
     2735,
 /**/
diff --git a/src/vim9execute.c b/src/vim9execute.c
index d3e2af772a..d6c4764882 100644
--- a/src/vim9execute.c
+++ b/src/vim9execute.c
@@ -2792,12 +2792,11 @@ call_def_function(
 		    else if (ltv->v_type == VAR_STRING)
 		    {
 			char_u	*str = ltv->vval.v_string;
-			int	len = str == NULL ? 0 : (int)STRLEN(str);
 
 			// Push the next character from the string.  The index
 			// is for the last byte of the previous character.
 			++idxtv->vval.v_number;
-			if (idxtv->vval.v_number >= len)
+			if (str == NULL || str[idxtv->vval.v_number] == NUL)
 			{
 			    // past the end of the string, jump to "endfor"
 			    ectx.ec_iidx = iptr->isn_arg.forloop.for_end;