Description:
------------
SplObjectStorage::unserialize does not sanitize the unserialized input well enough and may pass reference to object as key in the object storage.

lines 801-809 in ext/spl/spl_observer.c unserialize the entry and verify that it's of type IS_OBJECT

```
        if (!php_var_unserialize(&entry, &p, s + buf_len, &var_hash)) {
            goto outexcept;
        }
        if (Z_TYPE(entry) != IS_OBJECT) {
            zval_ptr_dtor(&entry);
            goto outexcept;
        }
```

Then, in line 812, the following code executes
```
            if (!php_var_unserialize(&inf, &p, s + buf_len, &var_hash)) {
```

If the parsed string is a reference (R:) to the entry zval, then the php_var_unserialize_internal() function will convert the entry to zval of type IS_REFERENCE (reference to the object).

Technically, this is a type-confusion, but I don't think it's (remotely) exploitable. I am reporting it as `security` just to be safe.

Test script:
---------------
<?php
$x = unserialize('a:2:{i:0;O:8:"stdclass":0:{}i:1;C:16:"SplObjectStorage":24:{x:i:1;r:2;,R:5;;m:a:0:{}}}');

if ($x[1]->contains($x[0])) {
    echo "expected\n";
} else {
    echo "unexpected\n";
}


Expected result:
----------------
"expected" should be printed.

Actual result:
--------------
"unexpected" is printed.