After running afl-fuzzer on expat for one night, I found a bunch of invalid shift xmltok_impl.c and xmltok.c.
To reproduce them, first build the source code with flag '-fsanitize=undefined' then compile the example code 'element.c'.
At last, execute command './element <$file', you will see a bunch of invalid shift.
Attached are the malformed input xml files.
Fixed since 2.2.0, commit https://github.com/libexpat/libexpat/commit/2106ee4050fd0d30e776e1c5a48937bb76a17074 , closing.