The ref wrapper always calls on lvalue.
Support data member access (INVOKE/4).