RPCs can still be called on torn off actors

Because UNetDriver::ProcessRemoteFunction does not check if the actor has been torn off, it's possible for the server to send a RPC for a torn off actor if it still exists on the server and client. In this case, UNetDriver::InternalProcessRemoteFunctionPrivate will create a new channel for the actor, and then UNetDriver::ProcessRemoteFunctionForChannelPrivate will perform the "initial" replication to open the channel (by calling UActorChannel::ReplicateActor). This also results in the client receiving any replicated properties that have changed since being torn off, as well as changing the torn off actor's role from ROLE_Authority on the client.

On the server, tear off a replicated actor.
After a delay (confirming that the actor has called TornOff and its role on the client is now ROLE_Authority), call a RPC on this actor. This RPC can be reliable or unreliable, multicast or client (if the torn off actor was owned by the client's connection).
Expected: The RPC will be dropped, since the actor is no longer replicated.
Actual: The RPC will be sent to the client, re-opening the actor's channel before closing it again due to being torn off.