Same bug encountered with php5.3-200810301330, also with a php crash.

Reproduce code:
---------------
<?php

var_dump ( set_error_handler ('myErrorHandler') );
restore_error_handler  ();
var_dump ( set_error_handler ('myErrorHandler') );

function myErrorHandler($errno, $errstr, $errfile, $errline)
{
    return true;
}

Expected result:
----------------
NULL
NULL

Actual result:
--------------
NULL
string(14) "myErrorHandler"
zend_mm_heap corrupted

Works fine with PHP_5_2, does not with PHP_5_3. 

I have tested tagged version in CVS:
php_5_3_0alpha1: OK (no bug)
php_5_3_0alpha2: ERROR (bug happened).

So, it seems this bug was introduced between alpha1 and alpha2.

If you give me a way to export cvs at a precise date, I can adjust when and where this bug was commited.

I tested several export from CVS and I found when was commited the bug: 
2008-08-11 17:00 GMT: OK (no bug)
2008-08-11 17:30 GMT: ERROR (bug happened).

Script used for information:
$ cvs -d :pserver:cvsread@cvs.php.net:/repository checkout -r PHP_5_3 -D"2008-08-11 17:30 GMT" php-src
$ cd php-src
$ ./buildconf --force && ./configure && make

I hope it can help. This is a major bug for me.

I made a patch to fix this bug and tested it *successfully* on php5.3-200811170930 (latest snap as I'm writing).

I am not an expert in diff/patch, so syntax may be wrong.

--- Zend/zend_API.c     2008-11-17 11:02:39.000000000 +0100
+++ Zend/zend_API.c     2008-08-08 19:47:28.000000000 +0200
@@ -3467,10 +3467,6 @@
 {
        current->handling = EG(error_handling);
        current->exception = EG(exception_class);
-       current->user_handler = EG(user_error_handler);
-       if (current->user_handler) {
-               Z_ADDREF_P(current->user_handler);
-       }
 }
 /* }}} */

@@ -3478,10 +3474,6 @@
 {
        if (current) {
                zend_save_error_handling(current TSRMLS_CC);
-               if (error_handling != EH_NORMAL && EG(user_error_handler)) {
-                       zval_ptr_dtor(&EG(user_error_handler));
-                       EG(user_error_handler) = NULL;
-               }
        }
        EG(error_handling) = error_handling;
        EG(exception_class) = error_handling == EH_THROW ? exception_class : NULL;
@@ -3499,15 +3491,6 @@
 {
        EG(error_handling) = saved->handling;
        EG(exception_class) = saved->handling == EH_THROW ? saved->exception : NULL;
-       if (saved->user_handler && saved->user_handler != EG(user_error_handler)) {
-               if (EG(user_error_handler)) {
-                       zval_ptr_dtor(&EG(user_error_handler));
-               }
-               EG(user_error_handler) = saved->user_handler;
-       } else if (saved->user_handler) {
-               zval_ptr_dtor(&saved->user_handler);
-       }
-       saved->user_handler = NULL;
 }
 /* }}} */

It seems my diff patch failed to apply on some configurations.
Here is full functions altered in Zend/zend_API.C (end of file, three functions modified):

ZEND_API void zend_save_error_handling(zend_error_handling *current TSRMLS_DC) /* {{{ */
{
        current->handling = EG(error_handling);
        current->exception = EG(exception_class);
}
/* }}} */

ZEND_API void zend_replace_error_handling(zend_error_handling_t error_handling, zend_class_entry *exception_class, zend_error_handling *current TSRMLS_DC) /* {{{ */
{
        if (current) {
                zend_save_error_handling(current TSRMLS_CC);
        }
        EG(error_handling) = error_handling;
        EG(exception_class) = error_handling == EH_THROW ? exception_class : NULL;
}
/* }}} */

ZEND_API void zend_restore_error_handling(zend_error_handling *saved TSRMLS_DC) /* {{{ */
{
        EG(error_handling) = saved->handling;
        EG(exception_class) = saved->handling == EH_THROW ? saved->exception : NULL;
}
/* }}} */

Please try using this CVS snapshot:

  http://snaps.php.net/php5.3-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/

I can not reproduce this anymore using latest CVS.

The bug seems to be fixed (tested successfully with php5.3-200811251530 on Linux).