jscript: Don't pass EXPR_NEWREF flag to evaluate member expression in array_expression_eval.

dlls/jscript/engine.c

@@ -1396,7 +1396,7 @@ HRESULT array_expression_eval(exec_ctx_t *ctx, expression_t *_expr, DWORD flags,
 
     TRACE("\n");
 
-    hres = expr_eval(ctx, expr->member_expr, EXPR_NEWREF, ei, &exprval);
+    hres = expr_eval(ctx, expr->member_expr, 0, ei, &exprval);
     if(FAILED(hres))
         return hres;
 

dlls/jscript/tests/lang.js

@@ -863,6 +863,13 @@ ok(("1" in obj) === false, "1 is in obj");
 obj = [1,2,3];
 ok((1 in obj) === true, "1 is not in obj");
 
+obj = new Object();
+try {
+    obj.prop["test"];
+    ok(false, "expected exception");
+}catch(e) {}
+ok(!("prop" in obj), "prop in obj");
+
 ok(isNaN(NaN) === true, "isNaN(NaN) !== true");
 ok(isNaN(0.5) === false, "isNaN(0.5) !== false");
 ok(isNaN(Infinity) === false, "isNaN(Infinity) !== false");