Use After Free in str_replace

How it was found

#PoC

$a = "A"*50
$a.replace($a)
$b = "B"*50
puts $a

#Output

$ ./bin/mruby test6.rb
BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB

The output should be "AAA...", but it prints "BBB...".

#Cause $a is freed in https://github.com/mruby/mruby/blob/5e3077c00da721ede78c07d2f2e261aded74e7b6/src/string.c#L523 and, the pointer is assigned to the same pointer in https://github.com/mruby/mruby/blob/5e3077c00da721ede78c07d2f2e261aded74e7b6/src/string.c#L531