malloc/free triggers assertion in a nudge thread's thread_exit event

DR 5 nn Win7x64: in the following sample free() triggers assertion after one nudges the process:
```
# include
# include

void *d = 0;
void on_thread_init(void *drcontext)
{
d = malloc(10000);
}
void on_thread_exit(void *drcontext)
{
free(d);
}
DR_EXPORT void dr_init(client_id_t id)
{
dr_register_thread_init_event(on_thread_init);
dr_register_thread_exit_event(on_thread_exit);
}
```