There seems to be a misconception in the COM code that a IDispatch variable with VARDESC.wVarFlags = VARFLAG_FDEFAULTBIND is the value to return as the object's default value. Default binding is used as a flag on ActiveX Control Properties to tell which control property that is to be bound to a datasource. This kind of binding may be either a variable (VARDESC) or a function (FUNCDESC).

The code looks like the programmer has intended to fetch the objects default value. This value is by OLE Automation defined as having DISPID = DISPID_VALUE. 

com_write_dimension and com_read_dimension should be rewritten to call php_com_do_invoke_by_id using DISPID_VALUE.

com_object_cast should be rewritten to use VariantChangeType directly to do the cast:

static int com_object_cast(zval *readobj, zval *writeobj, int type, int should_free TSRMLS_DC)
{
	php_com_dotnet_object *obj;
	VARIANT v;
	VARTYPE vt = VT_EMPTY;
	int ret;
	HRESULT hr;

	if (should_free) {
		zval_dtor(writeobj);
	}

	ZVAL_NULL(writeobj);

	obj = CDNO_FETCH(readobj);
	VariantInit(&v);

	switch(type) {
		case IS_LONG:
			vt = VT_INT;
			break;
		case IS_DOUBLE:
			vt = VT_R8;
			break;
		case IS_BOOL:
			vt = VT_BOOL;
			break;
		case IS_STRING:
			vt = VT_BSTR;
			break;
		default:
			return FAILURE;
	}

	if (FAILED(hr=VariantChangeType(&v, &obj->v, 0, vt))) {
		return FAILURE;
	}

	ret = php_com_zval_from_variant(writeobj, &v, obj->code_page TSRMLS_CC);
	VariantClear(&v);
	return ret;
}

This also makes com_object_cast to obey the rule of returning FAILURE if it is unable to return the required zval type.

Wez, could you have a look?

This seems to be related to Bug#29583 (com_dotnet crashes when trying to strlen).

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.