NSPropertyListSerialization: fix ref params