Fix occasional segfault when deallocating spied objects

This crash was hard to reproduce because it would only occur if the spy
was being deallocated and its memory address was going to be reused
shortly afterwards. In this case, we'd set the isa pointer back to a
CDRSpy, effectively overwriting some memory we no longer own.

Determining if you've been deallocated (or if any object has been, for
that matter) is hard.

We wrote a little script to run the OS X Specs target that was useful for verifying this fix (and for demonstrating it failing before we fixed it).

```ruby
#!/usr/bin/env ruby
`rm -rf build`
`xcodebuild SYMROOT=build -project Cedar.xcodeproj -target Cedar clean install DSTROOT=/`
exit 3 if $? != 0
`xcodebuild SYMROOT=build -project Cedar.xcodeproj -target Specs clean build`
exit 1 if $? != 0

100.times do |i|
  puts i
  `build/Release/Specs`
  if $? != 0
      puts 'PANIC'
      exit 2
  end
end
```