This is sufficient to reproduce it:

<?php
$mbox = imap_open('{imap.company.com:143}', 'username', 'password');
$h = imap_header($mbox, 1);
echo 'foo'; // output to differentiate between segfault and no output
?>


And here's a backtrace:

#0  0x81b0c94 in ?? ()
#1  0x807bb5f in add_assoc_object (arg=0xbfffcc90, key=0x8125932 "to", tmp={
      value = {lval = 137656000, dval = -1.9619407959466315, str = {
          val = 0x83476c0 "\005", len = -1073781732}, chval = -64 '?', 
        ht = 0x83476c0, obj = {ce = 0x83476c0, properties = 0xbfff641c}}, 
      type = 4 '\004', EA = {locks = 92, is_ref = 0}, refcount = 849})
    at imap.c:184
#2  0x807d827 in php3_imap_headerinfo (ht=2, return_value=0xbfffcc90, 
    list=0x81990fc, plist=0x8199128, this_ptr=0x0) at imap.c:1205
#3  0x80b0427 in execute (op_array=0x81cf880) at zend_execute.c:1358
#4  0x807602c in php_execute_script (primary_file=0xbffff9b0) at main.c:1121
#5  0x80760a0 in apache_php_module_main (r=0x81c78d4, fd=19, 
    display_source_mode=0) at main.c:1163
#6  0x8074a23 in send_php ()
#7  0x8074a68 in send_parsed_php ()
#8  0x80b6803 in ap_invoke_handler ()
#9  0x80c9549 in process_request_internal ()
#10 0x80c95ac in ap_process_request ()
#11 0x80c133e in child_main ()
#12 0x80c157c in make_child ()
#13 0x80c1629 in startup_children ()
#14 0x80c1c46 in standalone_main ()
#15 0x80c23b3 in main ()
#16 0x400afcb3 in __libc_start_main (main=0x80c208c <main>, argc=1, 
    argv=0xbffffb64, init=0x8061378 <_init>, fini=0x811e94c <_fini>, 
    rtld_fini=0x4000a350 <_dl_fini>, stack_end=0xbffffb5c)
    at ../sysdeps/generic/libc-start.c:78