Bug 744836: Modify nsTimerEvent to hold its timer reference until the nsTimerEvent itself is destroyed. r=bsmedberg,ehsan