Ref-counted objects must not be stack allocated. Make DOM::Document's constructor private to avoid this issue. (I wish we could mark classes as heap-only..)