<?
  $token['not'] = '?';
  $token['or'] = 'V';
  $token['and'] = '^';
  $token['xor'] = 'x';

  $statement = "A^BVC";

  function parse($statement)
  {
    global $token;
    for($i = 0; $i < strlen($statement); $i++)
    {
      $c = substr($statement, $i, 1);
      if($c == $token['and'] || $c == $token['or'] || $c == $token['xor'])
      {
        if(!$a) echo "Error: $c requires 2 arguments<br>\n";
        else if($a && $b)
        {
          $a[$o][a] = $a;
          $a[$o][b] = $b;
          unset($b);
        }
        $o = $c;
      }
      else
      {
        if($o)
          $b .= $c;
        else
          $a .= $c;
      }
    }
    if($a && $o && $b)
    {
      $ret[$o][a] = $a;
      $ret[$o][b] = $b;
    }
    else
    {
      echo "Error: missing statement<br>\n";
    }
    return $ret;
  }

  function aview($var)
  {
    while(list($key, $val) = each($var))
    {
      echo $key;
      if(is_array($val))
        aview($val);
      else
        echo $val;      
    }
  }

  $parse_tree = parse($statement);

//  aview($parse_tree);
?>

My machine is compiled with:
./configure --with-mysql=/usr/local --with-gd
The php binary is copied to /bin

It also has php built as a shared apache module
(--with-apxs=/www/bin/apxs)

It crashes on both.

I ftp'd the file to 2 of our production servers.  One has php/apache installed from RPM's the other is built from source.

It crashes with or without the aview function. If you put an
echo "hello";
at the very end, it crashes after printing hello.

here is the gdb backtrace:

#0  chunk_free (ar_ptr=0x40202d40, p=0x8173a30) at malloc.c:3049
#1  0x4016df9a in __libc_free (mem=0x8173a38) at malloc.c:3023
#2  0x80c51c9 in _efree (ptr=0x8173a44) at zend_alloc.c:232
#3  0x80c55e8 in shutdown_memory_manager (silent=0, clean_cache=0)
    at zend_alloc.c:437
#4  0x805e8a9 in php_request_shutdown (dummy=0x0) at main.c:667
#5  0x805d9fa in main (argc=2, argv=0xbffffb94) at cgi_main.c:751