When the reference identificator in replacement parameter is followed by other regular php variable, the variable is parsed, and after that the number of reference is catched.

<?
$str = "Something to be replaced 7";
$rpl = 6;
echo preg_replace("/^(.*?)[0-9]*$/", "\\1$rpl", $str);
?>

When I expect 7 to be replaced with 6, preg_replace() searches for reference \\16. The problem can be resolved with adding some /e stuff, ot just modifying the regexp.

<?
$str = "Something to be replaced 7";
$rpl = 6;
echo preg_replace("/^(.*?)[0-9]*$/e", "'\\1'.\$rpl", $str);
?>

Even, I can use some of the things proposed in:

http://bugs.php.net/bug.php?id=15166

Ok, but /e makes the whole thing slower...\\1\\99$rpl is a good solution, but what happens when the maximum number of references becomes 999? :-)

So, the behavior of the function is a little strange in this case...because in the second parameter two things has to be parsed. Once php variables, and then regexp references.

In my opinion, this is a bug. Maybe it's difficult to change the whole parsing mechanism of php cause of one exception, but the exception is already there - references can be numbers (like in Perl), $1, $2, etc...