This sounds rather artificial to be security issue.

There is CVE-2010-3436 releated to open_basedir, so I think this is a security issue as well. Please review it.

There is CVE-2010-3436 releated to open_basedir, so I think this is a security issue as well. Please review it

I'm not sure how existance of CVE-2010-3436 changes anything.

As I mentioned before, fopen is not the only way. If an user has ability to use any function that open/read/write a file on server with an arbitraty length, this vulnerability can leads to DoS or RCE in some situations. include, file_get_contents are also vulnerable for instance.

In your example, the error is not in the code you were talking about. It actually would never get there, as before that it'd get to php_check_open_basedir_ex which checks the length. Your backtrace shows crash in the error message printing.

The crash seems to be happening because of some problem in allocation routines, I'll dig deeper to see what's going on.

You are correct ! The error is not occurred in php_check_specific_open_basedir. Sorry for the mistake.
The error in fact occurred in xbuf_format_converter (which is called by vspprintf() in php_verror() ) while trying to print error message contains my large input. 
In the below debugging result, it seems like memcpy() tries to read an unmapped memory location, which causes segment fault.
Although the root cause is not what I mentioned in the previous comments, I do think this a security issue.

Debugging result:
-------------------
Continuing.
[----------------------------------registers-----------------------------------]
RAX: 0x7ffef6600018 ('a' <repeats 200 times>...)
RBX: 0x1
RCX: 0x7ffff687f252 --> 0x5060000000000000 ('')
RDX: 0xfffffff0
RSI: 0x7ffef6600018 ('a' <repeats 200 times>...)
RDI: 0x7ffff687f252 --> 0x5060000000000000 ('')
RBP: 0x7fffffffa800 --> 0x7fffffffa850 --> 0x7fffffffa940 --> 0x7fffffffaa40 --> 0x7fffffffaa80 --> 0x7fffffffaaa0 (--> ...)
RSP: 0x7fffffffa2c0 --> 0x0
RIP: 0x7b6545 (<xbuf_format_converter+10062>:	call   0x422a80 <memcpy@plt>)
R8 : 0xd65060 ("/home/ubuntu/php-src/main/spprintf.c")
R9 : 0x32e
R10: 0x7d8555 (<php_plain_files_stream_opener>:	push   rbp)
R11: 0x7ffff6858898 --> 0x72 ('r')
R12: 0x422c80 (<_start>:	xor    ebp,ebp)
R13: 0x7fffffffe680 --> 0x2
R14: 0x7ffff6814030 --> 0x7ffff68691e0 --> 0x8a5593 (<ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER>:	push   rbp)
R15: 0x7ffff68691e0 --> 0x8a5593 (<ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER>:	push   rbp)
EFLAGS: 0x202 (carry parity adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x7b6538 <xbuf_format_converter+10049>:	mov    rax,QWORD PTR [rbp-0x4b0]
   0x7b653f <xbuf_format_converter+10056>:	mov    rsi,rax
   0x7b6542 <xbuf_format_converter+10059>:	mov    rdi,rcx
=> 0x7b6545 <xbuf_format_converter+10062>:	call   0x422a80 <memcpy@plt>
   0x7b654a <xbuf_format_converter+10067>:	mov    rax,QWORD PTR [rbp-0x460]
   0x7b6551 <xbuf_format_converter+10074>:	mov    rdx,QWORD PTR [rbp-0x470]
   0x7b6558 <xbuf_format_converter+10081>:	mov    QWORD PTR [rax+0x8],rdx
   0x7b655c <xbuf_format_converter+10085>:	jmp    0x7b6580 <xbuf_format_converter+10121>
Guessed arguments:
arg[0]: 0x7ffff687f252 --> 0x5060000000000000 ('')
arg[1]: 0x7ffef6600018 ('a' <repeats 200 times>...)
arg[2]: 0xfffffff0
arg[3]: 0x7ffff687f252 --> 0x5060000000000000 ('')
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffa2c0 --> 0x0
0008| 0x7fffffffa2c8 --> 0x0
0016| 0x7fffffffa2d0 --> 0x0
0024| 0x7fffffffa2d8 --> 0x0
0032| 0x7fffffffa2e0 --> 0x7fffffffa978 --> 0x3000000028 ('(')
0040| 0x7fffffffa2e8 --> 0xd65501 --> 0x6f00000000000073 ('s')
0048| 0x7fffffffa2f0 --> 0x100000000
0056| 0x7fffffffa2f8 --> 0x7fffffffa830 --> 0x7ffff687f200 ("File name is longer than the maximum allowed path length on this platform (4096): ")
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value

Breakpoint 2, 0x00000000007b6545 in xbuf_format_converter (xbuf=0x7fffffffa830, is_char=0x1, fmt=0xd65501 "s", ap=0x7fffffffa978)
    at /home/ubuntu/php-src/main/spprintf.c:814
814				INS_STRING(xbuf, s, s_len, is_char);
gdb-peda$ c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
[----------------------------------registers-----------------------------------]
RAX: 0xfffffffdffd80dd6
RBX: 0x1
RCX: 0x1ffffffe0
RDX: 0xfffffff0
RSI: 0x7ffef6600018 ('a' <repeats 200 times>...)
RDI: 0x7ffff687f252 ('a' <repeats 16 times>)
RBP: 0x7fffffffa800 --> 0x7fffffffa850 --> 0x7fffffffa940 --> 0x7fffffffaa40 --> 0x7fffffffaa80 --> 0x7fffffffaaa0 (--> ...)
RSP: 0x7fffffffa2b8 --> 0x7b654a (<xbuf_format_converter+10067>:	mov    rax,QWORD PTR [rbp-0x460])
RIP: 0x7ffff7020ef5 (movdqu XMMWORD PTR [rdi+rdx*1-0x10],xmm8)
R8 : 0xd65060 ("/home/ubuntu/php-src/main/spprintf.c")
R9 : 0x32e
R10: 0x7d8555 (<php_plain_files_stream_opener>:	push   rbp)
R11: 0x7ffff6858898 --> 0x72 ('r')
R12: 0x422c80 (<_start>:	xor    ebp,ebp)
R13: 0x7fffffffe680 --> 0x2
R14: 0x7ffff6814030 --> 0x7ffff68691e0 --> 0x8a5593 (<ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER>:	push   rbp)
R15: 0x7ffff68691e0 --> 0x8a5593 (<ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER>:	push   rbp)
EFLAGS: 0x10202 (carry parity adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x7ffff7020ee5:	cmp    rdx,0x20
   0x7ffff7020ee9:	movdqu XMMWORD PTR [rdi],xmm8
   0x7ffff7020eee:	movdqu xmm8,XMMWORD PTR [rsi+rdx*1-0x10]
=> 0x7ffff7020ef5:	movdqu XMMWORD PTR [rdi+rdx*1-0x10],xmm8
   0x7ffff7020efc:	ja     0x7ffff7020f10
   0x7ffff7020efe:	mov    rax,rdi
   0x7ffff7020f01:	ret
   0x7ffff7020f02:	data16 data16 data16 data16 nop WORD PTR cs:[rax+rax*1+0x0]
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffa2b8 --> 0x7b654a (<xbuf_format_converter+10067>:	mov    rax,QWORD PTR [rbp-0x460])
0008| 0x7fffffffa2c0 --> 0x0
0016| 0x7fffffffa2c8 --> 0x0
0024| 0x7fffffffa2d0 --> 0x0
0032| 0x7fffffffa2d8 --> 0x0
0040| 0x7fffffffa2e0 --> 0x7fffffffa978 --> 0x3000000028 ('(')
0048| 0x7fffffffa2e8 --> 0xd65501 --> 0x6f00000000000073 ('s')
0056| 0x7fffffffa2f0 --> 0x100000000
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x00007ffff7020ef5 in ?? () from /lib/x86_64-linux-gnu/libc.so.6

The problem is that memory allocator fails to reallocate block properly if old block was small but new block is huge. 

The fix is in security repo as c2a13ced4272f2e65d2773e2ea6ca11c1ce4a911 and in https://gist.github.com/97abe94b25f99e6426e37b8693f46063 (patch by nikic)

please verify

It seems to be fixed. I can't reproduce it anymore. 

May I ask for a CVE number ?

Thanks for your time.

correct bug name