Description:
------------
Hello There !

I have a serious problem with the 5.2.9 version and earlier versions of PHP.

I am running lighttpd with php as fastcgi.
php crash time to time when it is compilde without --enable-debug.
I have busy site about 20 mln page views per day.
	
I have made a backtrace 

Core was generated by `/usr/local/bin/php-cgi'.
Program terminated with signal 11, Segmentation fault.
[New process 4363]
#0  zend_mm_remove_from_free_list (heap=0xcf8300, mm_block=0xfd94b0) at /root/php-5.2.9/Zend/zend_alloc.c:832
832                     if (UNEXPECTED(prev->next_free_block != mm_block) || UNEXPECTED(next->prev_free_block != mm_block)) {
(gdb) bt
#0  zend_mm_remove_from_free_list (heap=0xcf8300, mm_block=0xfd94b0) at /root/php-5.2.9/Zend/zend_alloc.c:832
#1  0x0000000000709c88 in _zend_mm_free_int (heap=0xcf8300, p=0xfd94c0) at /root/php-5.2.9/Zend/zend_alloc.c:1979
#2  0x0000000000719df4 in shutdown_executor () at /root/php-5.2.9/Zend/zend_execute_API.c:313
#3  0x0000000000724893 in zend_deactivate () at /root/php-5.2.9/Zend/zend.c:860
#4  0x00000000006e263c in php_request_shutdown (dummy=<value optimized out>) at /root/php-5.2.9/main/main.c:1492
#5  0x0000000000798062 in main (argc=1, argv=0x7fff2f0df458) at /root/php-5.2.9/sapi/cgi/cgi_main.c:2053

The same script is working fine  when php was compiled with --enable-debug AND when user_id is filled not NULL then is NO crash 

We have use Zend as framework so the code when 



Reproduce code:
---------------
 case 'votes':
                        $oVote = PS_Vote_UserProfile::factory( PS_Auth::getInstance()->getProperty( 'user_id' ) );

and the function getProperty()

public function getProperty( $sName )
        {
                return $this->getUser()->$sName;
        }



Actual result:
--------------
segfault