Incorrect type warning for captured variable

In the following example, Closure incorrectly reports a type warning, because it seems to be incorrectly assuming that the variable `result` is `null`, even though it is modified by the function call `onSuccess`. It does _not_ warn if this call is moved above the `result = null` assignment.

``` javascript
(function() {
var result = null;
var onSuccess = function(r) {
result = r;
};

var example = function() {
// TypeError: Object.keys called on non-object
// Closure does *not* report this as an error
//console.log('result keys:', Object.keys(result));

result = null;
onSuccess({a: 1});
// WARNING - actual parameter 1 of Object.keys does not match formal parameter
console.log('result keys:', Object.keys(result));
};

example();
})();
```

I cannot even cast this to avoid the warning, because then I get an invalid cast:

```
WARNING - invalid cast - must be a subtype or supertype
from: null
to : Object
```