Fix use-after-free in browser

browser_load frees browser_dir but pos, which points to a substring of
browser_dir, is used afterwards.