Description:
------------
Using the latest stable Debian's PHP 5.2.6-1+lenny3. Can't use anything newer on this production server, sorry.

Note that this malfunction in regular expressions might create exploitable application vulnerabilities (for example, a forum routine to sanitize posts). So this should be treated as a security fix.


// This code works as expected and outputs: ttt www.exa.com/ZZZ ttt 

echo preg_replace( 
	 '#([a-z\.]+)+ZZZ#',
	 'i',
	 'ttt www.exa.com/ZZZ ttt');


// The following code is the same but it will not work, even though it
// should. It will produce just an empty string. The only difference
// between this call and the previous call is that the text contains
// a LONGER domain name (instead of "exa", it contains the word
// "example").

echo preg_replace( 
	 '#([a-z\.]+)+ZZZ#',
	 'i',
	 'ttt www.example.com/ZZZ ttt');


Note: preg_last_error() returns the bogus PREG_SET_ORDER, which should apply only to preg_match_all() and not to preg_replace().

Reproduce code:
---------------
echo preg_replace( 
	 '#([a-z\.]+)+ZZZ#',
	 'i',
	 'ttt www.example.com/ZZZ ttt');

Expected result:
----------------
ttt www.example.com/ZZZ ttt 

Actual result:
--------------
Empty string