fixed potential crash in CCScheduler::removeHashElement

If the scheduler is the last object to have retained the pElements target and
the targets desctructor calls CCScheduler::unschedule() invalid memory is
accessed as pElement->timers is already freed, but the pElement is not removed
yet.
Therefore the call to target->release() should be made after pElement has been
removed from the hash table
Added TestCase for crash in CCScheduler

The code seems to look wrong (and it sure is) however in real-world
applications it might not be that eays to tell who has ownership of the object,
especially if weak references are involved.
Merge pull request #2268 from Weeds/ccscheduler-fix

fixed #2003: Fixed potential crash in CCScheduler::removeHashElement.