[BUGFIX] Use existing API instead of ContentObjectRenderer

This Patch allows the usage of an HMENU with special = directory and
the Fallback Type 'Free mode'

Resolves: #88344
Related: #89368
Releases: master, 9.5
Change-Id: Ib7f53b4e061b6387e6b29b2545696a3eb2d015a0
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62527
Tested-by: TYPO3com <noreply@typo3.com>
Tested-by: Tobias Gaertner <tobias.gaertner@benaja-websolutions.com>
Tested-by: Benni Mack <benni@typo3.org>
Reviewed-by: Guido Schmechel <guido.schmechel@brandung.de>
Reviewed-by: Tobias Gaertner <tobias.gaertner@benaja-websolutions.com>
Reviewed-by: Benni Mack <benni@typo3.org>

typo3/sysext/frontend/Classes/ContentObject/Menu/AbstractMenuContentObject.php

@@ -675,8 +675,8 @@ protected function prepareMenuItemsForDirectoryMenu($specialValue, $sortingField
                 $id = $mount_info['mount_pid'];
             }
             // Get sub-pages:
-            $statement = $this->parent_cObj->exec_getQuery('pages', ['pidInList' => $id, 'orderBy' => $sortingField]);
-            while ($row = $statement->fetch()) {
+            $rows = $this->sys_page->getMenu($id, '*', $sortingField);
+            foreach ($rows as $row) {
                 $tsfe->sys_page->versionOL('pages', $row, true);
                 if (!empty($row)) {
                     // Keep mount point?