Description:
------------
ArrayAccess(AA) interface bug.

If you try get element of obj, which implements AA interface by index($obj[$index]) and $index ? result of any scalar operation($obj[$index+1], it will crush apache server.

p.s. sorry for my English.



Reproduce code:
---------------
[code]
class Collection implements ArrayAccess
	{
		private $items = null;
		private $counter = null;
		function __construct()
		{
			$this->items = array();
			$this->counter = 0;
		}
		function add($obj)
		{
			$this->items[$this->counter++] = $obj;
		}
		function offsetExists($offset)
		{
			if (isset($this->items[$offset]))
			{
				return true;
			}
			return false;
		}
	
		function offsetGet($offset)
		{
			if (isset($this->items[$offset]))
			{
				return $this->items[$offset];
			}			
		}
	
		function offsetSet($offset, $value)
		{
			// readonly
		}
	
		function offsetUnset($offset)
		{
			// readonly
		}
		function count()
		{
			return $this->counter;
		}	
	}
	
	$arr = array("key1"=>0,
	"key2"=>"");
	
	$arr["key1"] = 1;
	$arr["key2"] = "test";
	
	$arr1[] = $arr;
	
	$col = new Collection();
	$col->add($arr1);
	
	$num = $col->count();
	if ($num > 0)
	{
		for($i=0;$i<$num;$i++)
		{
			echo "<pre>";
			print_r($col[$i+0]); //crush 
			echo "</pre>";
		}
	}
[/code]