Description:
------------
Tested with php 5.3.8 on Windows 7, 5.4.0RC2 Win32, and 5.4.0RC2 (cli) on Ubuntu 10.04.3

When an object is implicitly used as a string when passed to some php functions, __toString is called as expected, but any assignments of $this from within __toString are eventually broken and point instead to the string that gets returned. This behavior occurs only in some php functions, and never if you cast as string while passing into the functions.

This behavior has been observed when passing objects into at least these php functions:
str_replace, preg_replace, preg_match_all, sprintf.

There are many php string functions that do not behave this way (they allow __toString-created references to $this persist as references to the object).

For extra fun, play around with htmlspecialchars, echo-ing the output... I suspect that's a whole different issue, but related (possible memory leak there).


Test script:
---------------
<?php
class Primary {
 public function __toString() {
  $GLOBALS['anObject'] = $this;
  return 'toString output from Primary';
 }
}
$Foo = new Primary;
str_replace('', '', $Foo);
var_dump($GLOBALS['anObject']); 
// expected to be object of class Primary, actually string

Expected result:
----------------
object(Primary)#1 (0) { } 

Actual result:
--------------
string(28) "toString output from Primary"