We should test recovery in test/format.

michaelcahill comments:

> The closest type of testing we have to what you are describing is in the test/format directory of our main tree. We run that test continuously, including taking hot backups and making sure the backups are consistent. That is not the same as killing the process randomly, but it does exercise the same recovery paths. We would probably wrap test/format in a script that kills it randomly and re-opens the database to test what you're describing.