vfs:  Fix filehandle destruction order

Call the user-provided destructor first, then release the the file -- if
we don't, and the destructor calls get_file(), it gets a stale object --
and if that didn't break anything, the additional add_ref/release causes
another call to free() (which reliably aborts using 10.8's dev tools, at
least).

This happened with MacRelix's destroy_lock_handle() on OS X 10.8, though
not 10.4 (at least not reliably or frequently).