Ok I can reproduce.

Try replacing your require (which generates E_COMPILE_ERROR) by an unknown 
function call (which generates E_ERROR), and all's just fine

So there is a trick in the error engine, any kind of fatal shouldn't be handled 
by user defined error handlers, here we got proof it's not the case

Tip: Reproduced on 5.3.10 as well

Together with https://bugs.php.net/bug.php?id=61767 it is a bit more clear under which circumstances this occurs:

1. A non-fatal error is thrown
2. The error handler throws an Exception
3. A fatal error is thrown

In this particular case:

1. require() throws an E_WARNING (Warning: require(notfound.php): failed to open stream: No such file or directory).
2. The error handler throws the Exception
3. require() throws an E_COMPILE_ERROR (Fatal error: require(): Failed opening required 'notfound.php')

So, this is what I think is happening here:

1. The first non-fatal error (here warning) throws an Exception, i.e. sets EG(exception)
2. The second fatal error then causes a zend_bailout() moving us directly to php_request_shutdown()
3. During the shutdown sequence PHP will try to call the shutdown handler using call_user_function().
4. As EG(exception) is still set, the call is not allows (see http://lxr.php.net/xref/PHP_TRUNK/Zend/zend_execute_API.c#775).

I tried adding an EG(exception) = NULL; at the start of php_request_shutdown() and it indeed fixes the issue. Though probably that's not the right way to fix this.

@nikic: I can generate the same path without the first non-fatal error:

----------------------------------------------------------------------

register_shutdown_function(function(){echo("\n\n!!!shutdown!!!\n\n");});
set_error_handler(function($errno, $errstr, $errfile, $errline){throw new Exception("Foo");});

class Bad {
    public function __toString() {
        throw new Exception('Oops, I cannot do this');
    }
}

$bad = new Bad();
echo "$bad";

----------------------------------------------------------------------

This is on 5.3.10, like @jpauli report, and 5.4.6 as well.

The @laruence EG(exception) = NULL patch handles this case as well.  AFAIK, that patch is appropriate.

This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.

The same as #61767.