TCO wouldn't apply here anyway, it's not a tail call.  I suppose the base case here is when 'object' doesn't have a subhash, which means we're dealing with a recursion depth equal to the depth of the yaml file.  That's not going to blow the stack.
'object' is definitely not a descriptive enough word though, and why have "acc" as an accumulator instead of updated from  value returned from "normalize"?