In escape.d, the `bool isFirstRef()` function incorrectly accepts the first ref parameter as a `return scope` destination, even when there is a `this` parameter that should be the only return destination. This allows you to escape a stack pointer:
```
@safe:
    
struct S
{
    int* ptr;
    void assign(ref int* refPtr, return scope int* z) scope
    {
        this.ptr = z; // allowed, first ref
        refPtr = z; // should not be allowed
    }
}

int* escape()
{
    int local;
    
    S escapeThis;
    int* escapeRef;
    
    escapeThis.assign(escapeRef, &local);

    return escapeRef; // Accepts invalid
    return escapeThis.ptr; // Error, correct
}
```