Fix old call to toLowerCase() function.

Originally dom.js "snapshotted" standard methods of JS objects at startup,
in order to protect itself from user monkey-patching.  (See src/snapshot.js
in dom.js.)  This was reverted when domino was forked from dom.js, since
domino doesn't try to protect itself from malicious user code --- but one
case managed to sneak through.  Fix it!