Fix namespace axis traversal

When the namespace axis is traversed in "toBool" mode, the traversal
can exit early, before visiting all nodes. In this case, the XPath
context still contains a non-NULL tmpNsList.

This means that

- the check when to start a new traversal was wrong and
- the tmpNsList could be leaked.

Fixes bug #750037 and, by accident, bug #756075:

https://bugzilla.gnome.org/show_bug.cgi?id=750037
https://bugzilla.gnome.org/show_bug.cgi?id=756075