Fix use-after-free: there's only one spot where tracees can be safely freed.

This spot is right before calling waitpid(): at this moment no tracees
are supposed to be pointed to.