@dmity: Could you please take a look whether the ZEND_FETCH_ADD_LOCK in foreach [1] is still necessary? I tried removing it [2] and I didn't get any test failures in Zend/ or tests/, so maybe this is just a leftover?

 [1]: http://lxr.php.net/xref/PHP_TRUNK/Zend/zend_compile.c#6237
 [2]: https://gist.github.com/nikic/6800754

Nikita, I think you are right, and ZEND_FETCH_ADD_LOCK may be removed, because now the situation that it handled resolved by the code at the end of the handler, anyway.

I mean the situation when array might be destroyed right in ZEND_FETCH_OBJ_W handler and EX_T(opline->result.var).var.ptr_ptr would be incorrect. e.g.

<?php
function foo() {
	return array((object)array('x'=>array('a','b','c')));
}

foreach (foo()[0]->x as &$x) {
	echo "$x\n";
}
?>

Now it must be handled by:

	if (OP1_TYPE == IS_VAR && OP1_FREE && READY_TO_DESTROY(free_op1.var)) {
		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
	}

So, your patch looks fine (I hope I didn't miss anything important)
Fell free to commit it into PHP-5.5 and above.

Please, also check if we need to set "opline->extended_value = 1" for ZEND_FREE/ZEND_SWITCH_FREE opcodes in generate_free_foreach_copy().
I think we don't need it anymore as well.