Pass address of pointer, not value, again

In (at least) four places in the ROOT 6 specific conditions code, the address of a pointer to an object needed to be passed to an ObjectWithDict constructor.
Unfortunately, the value of the pointer was passed instead (missing '&').
Two of these four were fixed in pull request #6521.
This pull request fixes the two cases of this that were missed in the prior pull request.
Editorial comment: I hate code that is not type safe.
This request also does some minor optimization by avoiding unnecessary ObjectWithDict::typeOf() calls, since the return value is already known.
Please merge this request as soon as convenient.