Fixed #2298 (new check: passing stack-address to free())