Description:
------------
See script outputs below.

Please note that the array is already broken after the first foreach run because the last array element is now a pointer.

Workaround for the second foreach loop:
Do a unset($val) between the two foreach loops.

Test script:
---------------
$a = array(1,2,3);
var_dump($a); // array(3) { [0]=> int(1) [1]=> int(2) [2]=> int(3) }
foreach ($a as &$val) { } // Now the array is broken
var_dump($a); // array(3) { [0]=> int(1) [1]=> int(2) [2]=> &int(3) }
foreach ($a as $val) { } // Now the array is destroyed
var_dump($a); // array(3) { [0]=> int(1) [1]=> int(2) [2]=> &int(2) }
echo $a[2]; // Output: 2, Expected: 3