BUG: Masked array filled method ignores fill value

When string fill value is passed to the filled method of
a masked array with object ('O') dtype, it is ignored and
masked elements are filled with '?' instead.

Fixes #4436