jscript: Fixed to_primitive for null dispatch.

dlls/jscript/jsutils.c

@@ -198,6 +198,11 @@ HRESULT to_primitive(script_ctx_t *ctx, VARIANT *v, jsexcept_t *ei, VARIANT *ret
         static const WCHAR toStringW[] = {'t','o','S','t','r','i','n','g',0};
         static const WCHAR valueOfW[] = {'v','a','l','u','e','O','f',0};
 
+        if(!V_DISPATCH(v)) {
+            V_VT(ret) = VT_NULL;
+            break;
+        }
+
         jsdisp = iface_to_jsdisp((IUnknown*)V_DISPATCH(v));
         if(!jsdisp) {
             V_VT(ret) = VT_EMPTY;

dlls/jscript/tests/lang.js

@@ -942,6 +942,7 @@ ok(nullDisp == null, "nullDisp == null");
 ok(getVT(true && nullDisp) === "VT_DISPATCH",
    "getVT(0 && nullDisp) = " + getVT(true && nullDisp));
 ok(!nullDisp === true, "!nullDisp = " + !nullDisp);
+ok(String(nullDisp) === "null", "String(nullDisp) = " + String(nullDisp));
 
 function do_test() {}
 function nosemicolon() {} nosemicolon();