Bug 981900 - Add OnHistoryReplaceEntry to nsISHistoryListener to handle history.replaceState. r=smaug