`require('query-string').parse('hasOwnProperty&hasOwnProperty');` breaks

Unsafe usage of `hasOwnProperty` means that parsing certain query strings will throw an error.

The following cases are also not working correctly:

```
qs.parse('__proto__');
qs.parse('__proto__&__proto__');
```

`Object.create(null)` should fix the problem.
