Description:
------------
When passing four arguments to pg_copy_to(), the resulting data is corrupted.

My guess is that pg_null_as is being freed improperly. A similar pointer is freed conditionally within pg_copy_from().

Could be related to segfault in bug 35168.

Test script:
---------------
// setup
pg_query($db, 'CREATE TEMP TABLE temp_test_table (a INT)');
pg_query($db, 'INSERT INTO temp_test_table VALUES (1)');

// success
var_dump(pg_copy_to($db, 'temp_test_table'));

// success
var_dump(pg_copy_to($db, 'temp_test_table', "\t"));

// failure
var_dump(pg_copy_to($db, 'temp_test_table', "\t", "\\\\N"));



Expected result:
----------------
Three identical arrays:

array(1) {
  [0]=>
  string(2) "1
"
}
array(1) {
  [0]=>
  string(2) "1
"
}
array(1) {
  [0]=>
  string(2) "1
"
}

Actual result:
--------------
The third array is corrupted:

array(1) {
  [0]=>
  string(2) "1
"
}
array(1) {
  [0]=>
  string(2) "1
"
}
array(1) {
  [0]=>
  string(2) "@�"
}