Does not traverse on manually appended nodes

[sanex3339]

replace walker does not traverse on manually appended nodes.

code:

var s = {'abc': 'cde'};

For example, when traversal enters in ObjectExpression node, it replaces this node and manually appends some other nodes at the parent BlockStatement node of this ObjectExpression node.

var s = {}; // this node is replaced by return from `enter` function
s['abc'] = 'abc'; // this node is appended manually

After that, traversal does not walk on newly added nodes on the current traversal loop in both enter and leave callbacks.

[sanex3339]

I think, we should update worklist on leave stage of node, based on updated candidates