Commit f9eff2a4 is not quite right
because it will leave the mpNext chain unreachable; that could perhaps
be imporoved by calling RemoveFromLayout(), but...

Actually the problem is basically that one of the deleted SwCellFrms
points to a SwTableBox with getRowSpan() -1 (because it has been merged)
and thus IsInCoveredCell() returns true and that causes ~SwCellFrm() to
skip disposing the SwAccessible stuff, so the SwCellFrm is still
contained in the SwAccessibleMap.

Because it's rather hard to prevent this sort of thing in general,
better change SwAccessibleMap::Dispose() to assume that if it found its
way into the SwAccessibleMap it should be disposed and removed.

Change-Id: Ib4cec6924cb026ae30bdac6857957adf237b4d70