Description:
------------
The following code causes the apache 1.3.27 compiled statically with php to crash. The apache process that tries to execute the script terminates with a segfault. When the function returns the value not by reference everything works OK.

These are my php.ini specific settings:

allow_call_time_pass_reference = Off
expose_php = Off
max_execution_time = 120     ; Maximum execution time of each script, in seconds
error_reporting  =  E_ALL
display_startup_errors = On
log_errors = On
error_log = /usr/local/apache/logs/php_log
register_argc_argv = Off
magic_quotes_gpc = Off
always_populate_raw_post_data = On
upload_tmp_dir = /tmp
upload_max_filesize = 16M
; SMTP = localhost
; sendmail_from = me@localhost.com
sendmail_path = "/usr/local/sbin/ssmtp -t"


Reproduce code:
---------------
lass lala
{
	var $val;
	
	function lala ()
	{
		$this->val = 0;
	}
	
	function &get_val ()
	{
		$inf = 88;
		$this->val = $inf;
		return ($inf);
	}
}

$obj = new lala;
$vvv = &$obj->get_val ();
echo $obj->val;