fixed potential crash in CCScheduler::removeHashElement

If the scheduler is the last object to have retained the pElements target and
the targets desctructor calls CCScheduler::unschedule() invalid memory is
accessed as pElement->timers is already freed, but the pElement is not removed
yet.
Therefore the call to target->release() should be made after pElement has been
removed from the hash table