two bug fixes

1. Don't set up the analysis in record phase
2. Stash away pointers to Function.prototype.call and
Object.prototype.toString in case of overwriting