Fix isset-related behaviour for ArrayObject subclasses

Summary: Unlike most objects, using isset on an ArrayObject will return false
if the element is null. However, `offsetExists` will return true in
this case, so we need to special case ArrayObject.

Commit 31104c56 introduced this special case handling, however it
would cause unexpected infinite recursion if `offsetGet` was
overridden in a child class and that child class used an expression
of the form `isset($this[$offset])`. Users were not expecting
`offsetGet` to be called as the result of an `isset` expression.

This commit fixes the behaviour by calling the `offsetGet` method
from the `ArrayObject` class, instead of the `offsetGet` method on
the supplied object.

Fixes #2871
Fixes #2495
Closes #2986

Reviewed By: ptarjan, jdelong

Differential Revision: D1397482

Pulled By: @JoelMarcey