Description:
------------
Caused by passing the same variable multiple times to the function, which makes a convert_to_<type>_ex() call to invalid the each pointer of parameter.

Test script:
---------------
<?php

$f = array(array('A', 'A'));

$z = substr_replace($f, $f, $f, 1);
var_dump($z, $f);

Actual result:
--------------
array(1) {
  [0]=>
  string(5) "0Dd	y"
}
array(1) {
  [0]=>
  string(1) "0"
}