Use after free reported in TokTok#278 occurs because toxav_kill()

calls msi_kill() (toxav.c:180) which frees msi_call instances (msi.c:161)
which are then used when call_remove() (toxav.c:1136) is called.
This fix prevents call_remove() from calling invalid pointer.

Fixes TokTok#278

toxav/toxav.c

@@ -188,6 +188,7 @@ void toxav_kill(ToxAV *av)
 
         while (it) {
             call_kill_transmission(it);
+            it->msi_call = NULL; /* msi_kill() frees the call's msi_call handle; which causes #278 */
             it = call_remove(it); /* This will eventually free av->calls */
         }
     }