The problem occurs when running the following code:

<?PHP

	$doc = domxml_new_doc ('1.0');

	$root = $doc->append_child ($doc->create_element ('root'));

	for ($i = 0; $i < 10; $i++) {
		$node = $root->append_child ($doc->create_element ('top_node_' . $i));
		for ($j = 0; $j < 10; $j++) {
			$child = $node->append_child ($doc->create_element (sprintf ('node_%s_%s', $i, $j)));
			for ($k = 0; $k < 10; $k++)
				$child->set_attribute (sprintf ('attribute_%s', $k), $i . "_" . $j . "_" . $k);
		}
	}

	print ($doc->dump_mem ());

?>

Apache 1.3.24 crushes with the following message (translated from Russian):

Program APACHE did crush when accessing memory page in module PHP4TS.DLL in adress 015f:1009c557.
Registers:
EAX=0529a2a0 CS=015f EIP=1009c557 EFLGS=00010206
EBX=007b82e0 SS=0167 ESP=01a3f998 EBP=01a3fac4
ECX=01a3f9a8 DS=0167 ESI=01a3f9a8 FS=6e0f
EDX=01a3f9f4 ES=0167 EDI=007b82e0 GS=6ff6
Bytes on address CS:EIP:
66 ff 48 0a 8b 06 66 8b 48 0a 66 85 c9 75 30 50 
Stack content:
007e9050 012b1b0a 01a3f9a8 012b1b7f 0529a2a0 007e9810 012b1b50 007e97b0 007e98d0 012b1b32 007e9810 007e9970 012b1b32 007e98d0 007e99f0 012b1ac4 

The same problem had occured on earlier versions of Apache/PHP, and had been tested on several machines.

If you try to decrement the number of 'for' cycles, the script will generate correct output. On FreeBSD system this script works correctly.