fix corner case in unsafe (#4783)

lib/compress.js

@@ -8522,11 +8522,12 @@ merge(Compressor.prototype, {
             } else if (exp instanceof AST_Dot) switch (exp.property) {
               case "toString":
                 // x.toString() ---> "" + x
-                if (self.args.length == 0 && !exp.expression.may_throw_on_access(compressor)) {
+                var expr = exp.expression;
+                if (self.args.length == 0 && !(expr.may_throw_on_access(compressor) || expr instanceof AST_Super)) {
                     return make_node(AST_Binary, self, {
                         operator: "+",
                         left: make_node(AST_String, self, { value: "" }),
-                        right: exp.expression,
+                        right: expr,
                     }).optimize(compressor);
                 }
                 break;

test/compress/pure_getters.js

@@ -1490,3 +1490,49 @@ issue_4751: {
         };
     }
 }
+
+super_toString: {
+    options = {
+        pure_getters: true,
+        unsafe: true,
+    }
+    input: {
+        console.log({
+            f() {
+                return super.toString();
+            },
+        }.f());
+    }
+    expect: {
+        console.log({
+            f() {
+                return super.toString();
+            },
+        }.f());
+    }
+    expect_stdout: "[object Object]"
+    node_version: ">=4"
+}
+
+this_toString: {
+    options = {
+        pure_getters: true,
+        unsafe: true,
+    }
+    input: {
+        console.log({
+            f() {
+                return this.toString();
+            },
+        }.f());
+    }
+    expect: {
+        console.log({
+            f() {
+                return "" + this;
+            },
+        }.f());
+    }
+    expect_stdout: "[object Object]"
+    node_version: ">=4"
+}