Use _objc_msgForward for intercepting method invocations

Following up on the tweet last night, here's an unproven proof-of-concept.

I haven't run this code, it's just to illustrate. I was wrong about one thing, getting around using `-invokeUsingIMP:`. You could do it, but using the private API is much easier. It's too bad it's private.