Description:
------------
I've managed to locate this very tricky bug. It makes my Apache crash. It happens when :
- Using simplexml_load_file()
- Using a function, where the SimpleXML arg is "referenced"

It doesn't happen when I don't reference the arg or if I use simplexml_load_string().

See the test script for example.

I'm testing on snap "php-master-ts-windows-vc14-x86-r531fa70" (can't test on a more recent snap, Apache crashes on service startup), with Apache/2.4.12 (Win32)

Test script:
---------------
==segfault.xml==
<Menu>
	<Node title="">
	</Node>
</Menu>
==PHP script==
<?php
$xml = simplexml_load_file('segfault.xml');
function test(&$xml)
{
	var_dump($xml);
}
test($xml->Node);

Expected result:
----------------
Dump of the SimpleXML object

Actual result:
--------------
Crash