Description:
------------
When a fatal error happens in a __sleep/__wakeup function, BG(serialize) and 
BG(unserialize) contents is left intact and the next request will get those pointers 
again, even though at that moment they are already freed by Zend memory manager 
during request shutdown.
If you're lucky, there is a chance you'll reuse them, which causes immediate crash.
The attached scripts demonstrates the problem with serialize() and I'm kinda lazy to 
do the same for unserialize(), especially taking into account that the patch is 
extremely simple.

Test script:
---------------
class bar1 {
	function __sleep() {
		foo();
	}
}

class foo1 {
	function __sleep() {
		var_dump(serialize(array("test", "1", 234)));
		var_dump(serialize(new bar1));
	}
}

$o = new foo1;

var_dump(unserialize('O:8:"stdclass":0:{}')); //to clear BG(serialize_lock)
var_dump(serialize($o));

Expected result:
----------------
.

Actual result:
--------------
.