Description:
------------
array_splice expects an array reference for its first argument. But sometimes you can pass it a function that doesn't return an array reference, and it will work.

The function has to be a static method inside a class, and it has to return a static variable of that class. In this case, array_splice will actually update the class's variable, which it shouldn't be able to do.

Even stranger, this behavior won't happen if you've assigned another variable to the result of that function.

In the example below, you only get the error message when you uncomment line 8. As far as I can tell, that should have no effect.

Reproduce code:
---------------
<?
class X {
  protected static $arr = array("a", "b", "c");
  public static function getArr() {
    return self::$arr;
  }
}
#$arr1 = X::getArr();
array_splice(X::getArr(), 1, 1);
print_r(X::getArr());
?>

Expected result:
----------------
Fatal error: Only variables can be passed by reference in test.php on line 9

Actual result:
--------------
Array
(
    [0] => a
    [1] => c
)