I spawn a script using exec() which produces ~120 lines of output, which I have stuffed into the output array passed as an argument to exec().  I invariably get a segfault w/ 4.0.1pl2, no problems w/ 3.x.  I've attached a backtrace.  Please feel free to email me if any more info is required.

Good luck!

-- GDB BACKTRACE --
Program received signal SIGSEGV, Segmentation fault.
0x401d2c06 in free () from /lib/libc.so.6
(gdb) bt
#0  0x401d2c06 in free () from /lib/libc.so.6
#1  0x401d298a in malloc () from /lib/libc.so.6
#2  0x401d337b in realloc () from /lib/libc.so.6
#3  0x401d2ffd in realloc () from /lib/libc.so.6
#4  0x403b97fb in _erealloc () from /usr/lib/apache/1.3/libphp4.so
#5  0x4040d7be in php_if_stat () from /usr/lib/apache/1.3/libphp4.so
#6  0x4040edcf in php_if_user_sprintf () from /usr/lib/apache/1.3/libphp4.so
#7  0x403c4579 in execute () from /usr/lib/apache/1.3/libphp4.so
#8  0x403c47cc in execute () from /usr/lib/apache/1.3/libphp4.so
#9  0x403c47cc in execute () from /usr/lib/apache/1.3/libphp4.so
#10 0x403e02a4 in php_execute_script () from /usr/lib/apache/1.3/libphp4.so
#11 0x403dccbc in apache_php_module_main () from /usr/lib/apache/1.3/libphp4.so
#12 0x403dd644 in send_php () from /usr/lib/apache/1.3/libphp4.so
#13 0x403dd692 in send_parsed_php () from /usr/lib/apache/1.3/libphp4.so
#14 0x80545b5 in ap_invoke_handler ()
#15 0x8063aeb in ap_some_auth_required ()
#16 0x8063b48 in ap_process_request ()
#17 0x805d2ac in ap_child_terminate ()
#18 0x805d40b in ap_child_terminate ()
#19 0x805d518 in ap_child_terminate ()
#20 0x805da06 in ap_child_terminate ()
#21 0x805e18b in main ()
#22 0x4019ba42 in __libc_start_main () from /lib/libc.so.6
(gdb)