fix CID 1433643

Coverity found control_free_all() was accessing flush_queued_event_pending without locking. This was actually an old latent bug dating back to when we added multithreading to this queue, but Coverity somehow didn't notice the other unlocked accesses.