Read after free in mrb_vm_exec with OP_ARYCAT reading R(B)

Slightly different one, this is a use after free (as reported by an ASAN compiled binary). This one *doesn't* affect mruby-engine with the current instruction limit and memory limit, but if they are increased then it does.

class Klazz
  def $thing.name
    [email protected]@thing.name *nil
  end
  f$thing.name
end