This one is different: Not in the memory manager, but in concat_function.

Kristian

kk@poe ~/Source/myphp3 $ !gdb
gdb php core
GDB is free software and you are welcome to distribute copies of it
 under certain conditions; type "show copying" to see the conditions.
There is absolutely no warranty for GDB; type "show warranty" for details.
GDB 4.16 (sparc-sun-solaris2.5.1), Copyright 1996 Free Software Foundation, Inc...
Core was generated by `php'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/lib/libresolv.so.2...done.
Reading symbols from /usr/lib/libm.so.1...done.
Reading symbols from /usr/lib/libdl.so.1...done.
Reading symbols from /usr/lib/libnsl.so.1...done.
Reading symbols from /usr/lib/libsocket.so.1...done.
Reading symbols from /usr/lib/libc.so.1...done.
Reading symbols from /usr/lib/libintl.so.1...done.
Reading symbols from /usr/lib/libmp.so.1...done.
Reading symbols from /usr/lib/libw.so.1...done.
Reading symbols from /usr/lib/nss_files.so.1...done.
#0  concat_function (result=0xefffeba8, op1=0xeffff078, op2=0xeffff098, free_op2=1)
    at operators.c:713
713                     result->value.str.val[result->value.str.len] = 0;
(gdb) bt
#0  concat_function (result=0xefffeba8, op1=0xeffff078, op2=0xeffff098, free_op2=1)
    at operators.c:713
#1  0x23644 in phpparse () at control_structures_inline.h:1470
#2  0x2b588 in php3_parse (yyin=0xd0e50) at main.c:1402
#3  0x2be1c in main (argc=1, argv=0xeffffb5c) at main.c:1731
(gdb)