heap-use-after-free in OP_RESCUE

The following input demonstrates a crash:

def e
	proc
ensure z rescue 
	yield 
end

e { 
	Class * def * x
	new { 
		Class * 0
	} 
	ensure 0[] = 00end rescue 
	0
} rescue
z