evaluate postfix