echo $taintedObject; does not infer taintedness from __toString()

[TysonAndre]

Same for string encapsulation ("Trace: $myClass")

Expected: The examples in https://psalm.dev/r/43fab1bc2a should emit TaintedOutput

Related to #3696

[psalm-github-bot]

I found these snippets:

https://psalm.dev/r/43fab1bc2a

<?php // --taint-analysis

class MyClass {
    public function __toString() {
        return $_GET['blah'];
    }
}

// echo (new MyClass())->__toString(); emits TaintedInput
$x = new MyClass();
echo "x: $x\n";
echo $x;

Psalm output (using commit c95ebfe):

No issues!