There is still problem in serialize/unserialize mechanism  used to restore session variables(after closing #8676 bug which was supoused to correct the problem). Here is simplest script I can produce that does apache segfault on my machine:

<?
class Cscreen {
	var $page;
	var $frames;

	function Cscreen() {
		$this -> frames = array();
	}
};

class CError_handler {
	var $msg_error;
	
	function CError_handler() {
		$this -> msg_error = new CMessage();
	}
};

class CConnection_Table {
	var $data;
	
	function CConnection_table() {
		$this -> data = array();
	}
	
	function mconnect($message,&$object,$method) {
		$data[0] = &$object;
		$data[1] = $method;
		$this -> data[$message -> msg_id][] = $data;
	}
};

class CMessage {
	var $data;
	var $msg_id;
	
	function CMessage($data = 0) {
		global $__CMSGID_NEXT;
		$this -> msg_id = $__CMSGID_NEXT++;
		$this -> data = $data;
	}
};

function MCONNECT(&$message,&$obj_name,$method_name) {
	global $__connection_table;
	$__connection_table -> mconnect($message,$obj_name,$method_name);
};

session_start();
session_destroy();
$__connection_table = new CConnection_table;
session_register("__connection_table");

$screen = new Cscreen();
session_register("screen");

$error_handler = new CError_handler($screen);
MCONNECT($error_handler -> msg_error,$screen,"fatal_error");
session_register("error_handler");
echo "done";
exit();