When assigning to a sloppy mode hoisting candidate we should bind both its local binding and its 'var' binding

[Saam Barati]

For example, this should work:
function foo() {
    assert(f === undefined);
    {
         assert(typeof f === "function")
         f = 42
         assert(f === 42);
         function f() { }
    }
    assert(f === 42);
}

We can't do this solely inside the bytecode generator. This requires some runtime support for the annoying dynamic cases, i.e:
function foo() {
    assert(f === undefined);
    {
        function f() { }
        with ({}) {
            assert(typeof f === "function")
            f = 42
            assert(f === 42);
        }
    }
    assert(f === 42);
}