Direct use of symbolic boolean values.

[BenSpencer]

In some cases there can be an implied branch with no source-code branch, which we will miss.

See _checkbox-direct-use-of-checked.html from 5673da2, which should match the behaviour of checkbox.html but does not see any branch.

Maybe we should be inserting some "pseudo-branch" on the return value of an onclick handler?

[sema]

It looks like a place where some "pseudo-branch" on the return value would be of use. I'm not sure however how to insert such a branch easily, since we only do that right now in the symbolic interpreter.