Adds function js_mstime_malloc

This function takes advantage of MSTIME's CTIMEAnimationBase::put_values function that's suitable for a no-spray technique (based on wtfuzz's PoC for MS13-008).

How to test:

Attach windbg, setup this breakpoint (Win XP + IE8):

bu mstime!CTIMEAnimationBase::put_values+0x216 ".printf \"[*] Allocating for pointers: 0x%08x\",eax; .echo ; g"

And then run the JavaScript.  The breakpoint should give you an address, do a "dda [address]" to check results.

Here's a testcase for that:
https://gist.github.com/wchen-r7/ac29eb40fb33ddb5ab29