Index: main/pbx.c
===================================================================
--- main/pbx.c	(revision 141327)
+++ main/pbx.c	(working copy)
@@ -3310,6 +3310,7 @@
 {
 	struct ast_hint *hint;
 	struct statechange *sc = datap;
+	struct ast_channel *bogus = ast_channel_alloc(0, 0, "", "", "", "", "", 0, "Bogus/%p", datap);
 	AST_RWLIST_RDLOCK(&hints);
 
 	AST_RWLIST_TRAVERSE(&hints, hint, list) {
@@ -3320,6 +3321,16 @@
 		int state;
 
 		ast_copy_string(buf, ast_get_extension_app(hint->exten), sizeof(buf));
+		if (strstr(buf, "${")) {
+			/* Evaluation needed */
+			char buf2[AST_MAX_EXTENSION];
+
+			ast_copy_string(buf2, buf, sizeof(buf2));
+			ast_copy_string(bogus->context, hint->exten->parent->name, sizeof(bogus->context));
+			ast_copy_string(bogus->exten, hint->exten->exten, sizeof(bogus->exten));
+			pbx_substitute_variables_helper(bogus, buf2, buf, sizeof(buf));
+		}
+
 		while ( (cur = strsep(&parse, "&")) ) {
 			if (!strcasecmp(cur, sc->dev))
 				break;
@@ -3349,6 +3360,7 @@
 	}
 	AST_RWLIST_UNLOCK(&hints);
 	ast_free(sc);
+	ast_channel_free(bogus);
 	return 0;
 }