Description:
------------
Unlike eval(), create_function can be called by reference.  It provides
an excellent hook for php obfuscation that is difficult to detect in an
automated way.  

I would like to define a list of functions that can NOT be called by
reference, and this function is first in my list, closely followed by
the other functions in this snippet, system(), ob_flush(), etc.  

Obfuscated code is one thing - obfuscated code that looks innocent is
another.

Reproduce code:
---------------
---
From manual page: function.create-function#Description
---
Note that this code does not contain a single string for a scanner.  Only a php interpreter can determine that this is obfuscated code, and calls str_rot13, base64_decode and runs the base64 encoded code.
<?php
$v="_"; $v.="rot"; $v.=14-1; $v="str$v";
$w=$v("onfr64_qrpbqr");
$x=$w('Y3JlYXRlX2Z1bmN0aW9u');
$y=$w('ZWNobyAiVSBSIHB3bmRcbiI7Cg==');
$z=$x('',$y);
$z();


Expected result:
----------------
Fatal error: Call to undefined function create_function()
or
Fatal error: function create_function cannot be called by reference.


Actual result:
--------------
U R pwnd