Array.prototype.concat.call('foo', …) should throw

In ES5 (and V8), `Array.prototype.concat.call('foo')` returns an array containing a String object (i.e., boxed string)—it's equivalent to `[new String('foo')]`. In our interpreter, it returns `['foo']`.

Since we forbid boxed primitives, the `new String()` call throws TypeError. The `concat` call should too.

At the moment, our implementation of `Array.prototype.concat` calls `intrp.toObject`, which notably does not throw, and then does nothing further with the result.