No crash with PHP 4.3.1-dev, does crash with PHP 5-dev.

Well... I have not had the time to solve it, but I now know pretty well why it is caused.

**can someone please have a crack at fixing this**?

In zend_language_parser.y, the rule for object_property is either an object_dim_list (which can be a T_STRING) or it is a "variable_without_ibjects".

object_dim_list works for $this->foo, but $this->$foo is matched by variable_without_objects.

HOWEVER, variable_without_objects is the match for vanilla variables, so it consumes one '$' before it dereferences.

in other words, $this->$foo sends the $foo part off to the standard variable compiler area which does not recognise that $foo is a reference.

I experimented by placing a couple of rules in the lex scanner as follows:

<ST_LOOKING_FOR_PROPERTY>"$" {

fprintf(stderr,"xxx");

  yy_push_state(ST_TEST)
  return '$';
}

and

<ST_TEST>";" {

fprintf(stderr,"yyy");

  yy_pop_state(TSRMLS_C);
  return ';';
}
<ST_TEST>{LABEL} {

fprintf(stderr,"zzz");

   zendlval->value.str.val = (char *)estrndup(yytext,yyleng);
   zendlval->value.str.len = yyleng;
   zendlval->type = IS_STRING;
   return T_VARIABLE;
}

and suddenly, it all seems to parse, however I'm clearly missing something - it still does not display the forrect output for

  echo $this->$foo;

What am I doing wrong?

No crash here.

In line 1, I assume you're expecting "hi" as an output. This will of course not work as $bar is not set.

Modify line 1 to read:
  echo $this->{$this->bar}

and you will have your expected output. Note that with error_reporting(E_ALL) you would notice such kinds of mistakes. Also, var_dump() helps a lot, you can actually see type information instead of just nothing appearing:)

thekid@friebes:~ > cat | php5
<?php
class myClass
{
    var $foo = "hi";
    var $bar = "foo";

    function test()
    {
      var_dump($this->{$this->bar});
      var_dump($this->foo);
    }
}

$c= new myClass();
$c->test();
?>
string(2) "hi"
string(2) "hi"

Not closed! Using September's 28 PHP5 CVS:

PHP Fatal error:  Method name must be a string in /www/var/template/%%-16/%%-1606537564/Contact.en.tpl.php

And the php file goes like this: 

<?php echo $this->_plugins['function']['mailto'][0](array('address' => "here@email.com",'encode' => 'javascript'), $this) ; ?>

(Smarty template.)
With this postfilter it works fine:

function dev_smarty_php5b1_fix_postfilter ($sTpl, &$oSmarty) {

  return preg_replace (
    '/echo (\$this-\>_plugins\[\'\w+\'\]\[\'\w+\'\]\[\d+\])/',
    '$dev_php5b1_fix = "{\1}"; echo $dev_php5b1_fix', $sTpl);
}