rpcrt4: Set the destination pointer in PointerUnmarshall before calling the referenced type's unmarshalling routine.

When a pointer that is dereferenced is encountered then this can result 
in a stale pointer (i.e. the one that is marshalled into the buffer for 
the embedded pointer unmarshalling case) being used instead of the one 
that was intended.