The following script segfaults reliably as both apache
module and CGI:

<?php error_log( "Banner bug", 1, "torben@localhost" ) ?>

mail() works fine; using the 4th argument doesn't affect
the problem. The mail gets sent either way.

(gdb) run -X -f conf/httpd.conf
Starting program: /usr/local/etc/apache_1.2.1/src/httpd -X -f conf/httpd.conf

Program received signal SIGSEGV, Segmentation fault.
0x8094a61 in _efree (ptr=0x80d45e3, filename=0x80d5618 "functions/mail.c", lineno=164)
    at alloc.c:162
162             REMOVE_POINTER_FROM_LIST(p);
(gdb) bt
#0  0x8094a61 in _efree (ptr=0x80d45e3, filename=0x80d5618 "functions/mail.c",
    lineno=164) at alloc.c:162
#1  0x80a4470 in _php3_mail (to=0x812b570 "torben@localhost",
    subject=0x80d45e3 "PHP3 error_log message", message=0x812b348 "Banner bug",
    headers=0x0) at functions/mail.c:164
#2  0x809aae7 in _php3_error_log (opt_err=1, message=0x812b348 "Banner bug",
    opt=0x812b570 "torben@localhost", headers=0x0) at functions/basic_functions.c:1339
#3  0x809aa61 in php3_error_log (ht=0x812b190, return_value=0x8101128, list=0x8101138,
    plist=0x8101164) at functions/basic_functions.c:1324
#4  0x80b851c in phpparse () at control_structures_inline.h:901
#5  0x808d750 in php3_parse (yyin=0x81233f0) at main.c:1394
#6  0x808da46 in apache_php3_module_main (r=0x811fa3c, fd=19, display_source_mode=0,
    preprocessed=0) at main.c:1786
#7  0x8069768 in send_php3 ()
#8  0x80697b0 in send_parsed_php3 ()
#9  0x80519c5 in invoke_handler ()
#10 0x8053f9d in process_request_internal ()
#11 0x8053fcd in process_request ()
#12 0x804edb1 in child_main ()
#13 0x804ee97 in make_child ()
#14 0x804f469 in standalone_main ()
#15 0x804f8e8 in main ()
#16 0x804c48b in _start ()
(gdb)