Description:
------------
It is possible to invoke class autoloaders with invalid class names leading to 
potential security issues. Classes can contain alphaumeric, underscore and 
backslash characters. However, code like:

    $foo = new $class

where $class might contain any arbitrary string will cause the autoloader stack 
to be called even if the $class variable contained invalid characters for a 
class name.

This could lead to various file inclusion issues as detailed in 
http://drak3.devmx.de/blog/2012/08/08/autoloaded-remote-file-inclusion/

However, it is not reasonable for classloaders to validate the class name passed 
to it via PHP for valid classname characters. Doing so would be an incredible 
burden on performance ever increasing with the size of the autoloader stack.

I suggest that PHP validate the characters of the class before deciding to call 
the autoloader stack or not.