Safer iteration when Array.prototype has been extended

Adds handling to certain `for (x in a)` patterns for safer iteration when Array.prototype
has been extended with enumerable properties.