Fix for a memory leak in dispatchEvent()

The array in question grows with duplicate entries everytime
dispatchEvent() is called when mixing onfoo="" with
addEventListener("foo", ...)
Event phase AT_TARGET should also fire capture listeners

Fixes #855
The event phase AT_TARGET should also fire events registered with
capture=true on the event target, not just capture=false. Note that
calling stopPropagation during AT_TARGET should not prevent any listeners
registered on that same event target from being called.
eventPhase and currentTarget should be reset after dispatch

As per spec, before and after an event has been dispatched,
Event.eventPhase should be set to NONE and Event.currentTarget should be
set to null.