Fix occasional crashes in tab element's destructor

The crashes were caused by attempts to free an already freed parent "tabset" element which it still had attached as an event listener. The change fixes the issue by accounting for listeners in reference counting for tab elements.

Include/Rocket/Controls/ElementTabSet.h

@@ -84,6 +84,12 @@ public:
 	/// Process the incoming event.
 	void ProcessEvent(Core::Event& event);
 
+	/// Called when the listener has been attached to a new Element
+	void OnAttach(Element* ROCKET_UNUSED(element));
+
+	/// Called when the listener has been detached from a Element
+	void OnDetach(Element* ROCKET_UNUSED(element));
+
 protected:
 	// Catch child add/removes so we can correctly set up their events.
 	virtual void OnChildAdd(Core::Element* child);

Source/Controls/ElementTabSet.cpp

@@ -223,5 +223,16 @@ Core::Element* ElementTabSet::GetChildByTag(const Rocket::Core::String& tag)
 	return element;
 }
 
+void ElementTabSet::OnAttach(Core::Element * ROCKET_UNUSED(element))
+{
+	AddReference();
+}
+
+void ElementTabSet::OnDetach(Core::Element * ROCKET_UNUSED(element))
+{
+	RemoveReference();
+}
+
+
 }
 }