fix an infinite loop in simplexml when grabbing an offset that should not exist

Zend PHP would check if a write operation was being done when getting an offset.
It does this in case of this being something like $sxe->prop[123] = 'something'.

In case of HHVM, those kinds of calls are always handled by offsetSet.

This fixes 2 additional failing zend tests, and I have added another (more clear)
repro that makes the problem more obvious.

Closes #1896.