Direct Rc/Weak cycle causes double free

``` rust
use std::rc::{Rc, Weak};
use std::cell::RefCell;

struct Cycle {
    x: RefCell<Option<Weak<Cycle>>>
}

fn main() {
    let a = Rc::new(Cycle { x: RefCell::new(None) });
    let b = a.clone().downgrade();
    *a.borrow().x.borrow_mut().get() = Some(b);
}
```

crashes with a double free when run, with and without optimisations.

I'm investigating.
