<?php
header("Location: http://example.com");
?>

HTTP dialog:

POST /test.php5 HTTP/1.1
Host: localhost
Content-Length: 0

HTTP/1.1 302
Date: Sat, 12 Mar 2005 15:28:40 GMT
Server: Apache/1.3.27 (Win32) PHP/4.3.3
X-Powered-By: PHP/5.0.2
Location: http://example.com
Transfer-Encoding: chunked
Content-Type: text/html

0



POST /test.php HTTP/1.1
Host: localhost
Content-Length: 0

HTTP/1.1 302 Found
Date: Sat, 12 Mar 2005 15:26:03 GMT
Server: Apache/1.3.27 (Win32) PHP/4.3.3
X-Powered-By: PHP/4.3.3
Cache-Control: no-cache
Location: http://example.com
Transfer-Encoding: chunked
Content-Type: text/html

0

I think most clients actually treat a 302 like a 303 in that case.  But yes, this should be fixed.  Unfortunately we don't have a clean way of doing this without adding the proto_num to the request_info struct.  Changing that struct would be a bad idea for PHP4 at this point.  I'll look into doing it for PHP 5.1.
As a workaround, just do:
header("Location: /foo",true,303);

This is fixed correctly CVS HEAD now.  We still may hack something based on SERVER_PROTOCOL into 4.3/5.0.