Sema.pointerDeref() assumes that elem_ptrs have been "flattened" when
they were created, so that you an elem_ptr will never be the array_ptr
of another elem_ptr when they share the same type.

Value.elemPtr does this already, but a couple of places in Sema were
bypassing this logic.