Bug 744836 - Modify nsTimerEvent to hold its timer reference until the nsTimerEvent itself is destroyed. r=bsmedberg, r=ehsan, a=lsblakk