uv_fs_poll_t has an embedded uv_timer_t handle that got closed at a time when
the memory of the encapsulating handle might already have been deallocated.
Solve that by moving the poller's state into a structure that is allocated on
the heap and can be freed independently.
* the callback gets called only once on error, not repeatedly...
* ...unless the error reason changes from e.g. UV_ENOENT to UV_EACCES
* the callback receives pointers to uv_statbuf_t objects so it can inspect what
changed
