Added SES tests for two Chrome bugs.

Added SES tests for two Chrome bugs:
1) If you make an array's length read-only and then add an element to
the array, the length gets changed.
2) In non-strict code, this fails:
var x = (function a() {
  function a() {} // Should mask outer defn
  eval(""); // Just has to be here; removing it changes the behavior
  return a;
});
assert(x() !== x);

The first bug is a violation with no known exploit; the second is safe
because we're in strict mode.

[felix8a, 2012-11-13 01:40:22]

lgtm