This is probably the same problem as bug 8459 but I no longer seem to be able to respond to other people's bugs so apologies for duplicating but this info may be useful in diagnosing the problem.  

Here's the relevant part of the gdb backtrace from Linux (RH 7.0, Sun JDK 1.3, Tomcat 3.2.1).  Not sure yet if the bug is in PHP/Java code or in zend_hash (since the latter is getting a 0 index into the hashtable).  BTW, this crash doesn't happen if you build the Debug_TS version (or --enable-debug on Ux).

#0  0x48a41ce6 in zend_hash_index_update_or_next_insert (ht=0x819134c, h=0, pData=0xbcfff19c, nDataSize=4,

     pDest=0x0, flag=1) at zend_hash.c:398

#1  0x48a50751 in Java_net_php_reflect_setResultFromObject (jenv=0x8171fdc, self=0xbcfff1e8, result=135860956,

     value=0xbcfff1f0) at java.c:729

#2  0x80694c1 in ?? ()

#3  0x8066da9 in ?? ()

#4  0x8066da9 in ?? ()

#5  0x4044ea50 in StubRoutines::_code1 () from /opt/jdk1.3/jre/lib/i386/client/libjvm.so

#6  0x4015f5e2 in JavaCalls::call_helper () from /opt/jdk1.3/jre/lib/i386/client/libjvm.so

#7  0x401dc731 in os::os_exception_wrapper () from /opt/jdk1.3/jre/lib/i386/client/libjvm.so

#8  0x4015f930 in JavaCalls::call () from /opt/jdk1.3/jre/lib/i386/client/libjvm.so

#9  0x401661ab in jni_invoke () from /opt/jdk1.3/jre/lib/i386/client/libjvm.so

#10 0x40169b1a in jni_CallObjectMethod () from /opt/jdk1.3/jre/lib/i386/client/libjvm.so

#11 0x48a4efc5 in sapi_servlet_read_cookies (sapi_globals=0x817ce70) at servlet.c:204

#12 0x48a54787 in sapi_activate (sapi_globals=0x817ce70) at SAPI.c:298

#13 0x48a51506 in php_request_startup (compiler_globals=0x80e4728, executor_globals=0x80e55b8,

     core_globals=0x80e05e8, sapi_globals=0x817ce70) at main.c:594

#14 0x48a4f43c in Java_net_php_servlet_send (jenv=0x8171fdc, self=0xbcfff5c4, requestMethod=0xbcfff5c0,
 
    queryString=0xbcfff5bc, requestURI=0xbcfff5b8, pathTranslated=0xbcfff5b4, contentType=0x0, contentLength=-1,
 
    authUser=0x0, display_source_mode=0 '\000') at servlet.c:360