Description:
------------
Testet on 5.2.0 and 5.2.1

I was able to reproduce segfaults in this situation
on the commandline and with apache!


Reproduce code:
---------------
<?php
class CrashHelper
{
    function call2($tpl_var, $value = null) {}
    function call1($value = null) {}
}

class Crash
{
	static function outerCall($param)
	{
		$ch = new CrashHelper();

#		$test = Crash::innerCall($param);
#		$ch->call2('test', $test);              // don't crash

#		$ch->call1(Crash::innerCall($param));   // don't crash

		$ch->call2('test', Crash::innerCall($param)); // crash
	}
	static function innerCall($param)
	{
		$backtrace = debug_backtrace();
		echo '<pre>'.var_export($backtrace, true).'</pre>';
	}
}

function doCrash($param)
{
#	$ch = new CrashHelper();
#	$ch->call2('test', Crash::innerCall($param));   // don't crash

	Crash::outerCall($param);
}

doCrash($_GET['id']);
?>


Expected result:
----------------
backtrace,
no crash

Actual result:
--------------
Speicherzugriffsfehler