Don't allow symbols in expressions unless we can evaluate them.

Fixes:	#916

bin/varnishtest/tests/r00916.vtc

+varnishtest "VCC reference bug"
+
+server s1 {
+	rxreq
+	txresp -body "FOO"
+} -start
+
+varnish v1 -badvcl {
+	sub s1 {
+	}
+	sub vcl_fetch {
+	    if (req.backend == s-1){
+		set req.backend = s-1;
+	    }
+	}
+}

lib/libvcl/vcc_expr.c

@@ -656,7 +656,7 @@ vcc_expr4(struct vcc *tl, struct expr **e, enum var_type fmt)
 		 * XXX: look for SYM_VAR first for consistency ?
 		 */
 		sym = VCC_FindSymbol(tl, tl->t, SYM_NONE);
-		if (sym == NULL) {
+		if (sym == NULL || sym->eval == NULL) {
 			vsb_printf(tl->sb, "Symbol not found: ");
 			vcc_ErrToken(tl, tl->t);
 			vsb_printf(tl->sb, " (expected type %s):\n",