Description:
------------
Taking a reference of an argument makes it also to be a reference in the stack trace, which allows to modify the value from any nesting level via 'args' key of debug_backtrace

Test script:
---------------
<?php

function test(string $val) {
    $a = &$val;
    hackingHere();
    print_r($val);
}

function hackingHere() {
    // we're able to modify the $val from here, even though the arg was not a reference
    debug_backtrace()[1]['args'][0] = 'Modified';
}

test('Original');

Expected result:
----------------
Should print 'Original'

Actual result:
--------------
Prints 'Modified', because `hackingHere` unexpectedly gets access to the argument.