For what it's worth, of course, I'll point out that this is the same difference in behaviour as when arrays vs. ArrayObjects are passed as arguments to functions. The array and the ArrayObject are both passed by value; in the array's case is the sequence of key/value pairs it is made up of; the ArrayObject's value is the ArrayObject itself.

In the same wise, the foreach() iterates over the value it is given to iterate over. That value isn't replaced while the loop is iterating. Changing the contents of an array changes its value (but the foreach doesn't see that - it's iterating over the value it was given). But changing the contents of an ArrayObject doesn't change its value - it's still the same ArrayObject, and its value is still the one given to the foreach).

<?
$foo = ['a','b']; // The value of $foo is the sequence 0=>'a', 1=>'b'
// $foo = new ArrayIterator(['a']); // The value of $foo is an ArrayIterator object.

foreach($foo as $b)
{
	echo $b;
	$foo[] = 'f';	// Append to $foo
}

echo "\n",count($foo),"\t",join($foo);
?>

Bug #75173 addressed an instance of the opposite problem to the current happening: the value of the Iterator object is the Iterator object, so the loop should have been iterating over that Iterator's elements.

Duplicate of bug #70246