Fix yet another bug in the THUNK_SELECTOR code.  Interestingly, I
spotted this one earlier but left a ToDo in the code rather than
fixing it (I think I wasn't sure whether it could happen or not).

The bug is to close another another way that eval_thunk_selector()
could return a pointer into to-space.  See comments for details.