This isn't going to be safe---the underlying array needs to know we're going to modify the TypedValue and turn it into a ref.  (For e.g. the underlying array could be a cross-request static array, and this would set it to point into a request local heap.)

There are a few other bugs in EZC like this (after the next push there should be some FIXMEs near a few of them).