Fix use-after-free in browser

browser_load frees browser_dir but ptr, which points to a substring of
browser_dir, is used afterwards.

---

It's funny that this hasn't ever crashed before. Heap fragmentation, I guess? I'm compiling with  -fsanitize=address in both CFLAGS and LFLAGS now which adds such checks to the code (at a 2x slowdown).