and add the test that exposed it.

addGuard(obj) is dangerous because obj could be deallocated+reallocated
in the same spot, which is what ended up happening here.