Fixed returning ByRef vars.

StealMem from the right var.

`return var` is now always an expression, so aResultToken is set in all
cases by either ExpandExpression or ExpandArgs.  Static/global vars are
returned without copying (except by caller).  Local vars returned via
ByRef are left for ExpandExpression to copy into the deref buffer.