sipsess/reply: fix heap-use-after-free bug

fixes #1178 - `mem_deref(sess)` calls list_flush(&sess->replyl)
within destructor and reply is a dangling pointer after this.

src/sipsess/reply.c

@@ -66,7 +66,8 @@ static void tmr_handler(void *arg)
 		}
 	}
 	else {
-		mem_deref(sess);
+		mem_deref(sess); /* list_flush derefs reply */
+		return;
 	}
 
 	mem_deref(reply);