Unhandled promise rejection with throwing toString crashes node

[bakkot]

• Version: 8.1.2

$ node
> Promise.reject({toString(){throw 42;}})
Promise {
  <rejected> { toString: [Function: toString] },
  domain:
   Domain {
     domain: null,
     _events: { error: [Function: debugDomainError] },
     _eventsCount: 1,
     _maxListeners: undefined,
     members: [] } }
>
repl:1
Promise.reject({toString(){throw 42;}})
                           ^
42

$

This is approximately the same issue as #11637. The fix, in #11640, dealt with only that case, not the full problem.