The following code causes PHP to die at line 3:
$mgr = new COM("Factory");
$child = $mgr->GetChild(1);
echo $child->Attribute;

($mgr's method GetChild returns a COM object, which
has property 'Attribute').

The bug is in php_variant_to_pval() function in 
ext/com/conversion.c, line 501:
 handle->value.lval = zend_list_insert(var_arg->pdispVal, php_COM_get_le_idispatch());

it saves raw interface pointer var_arg->pdispVal, whereas everywhere else it is expected that the list contains i_dispatch pointer.

The line should be replaced with 
 i_dispatch *obj = (i_dispatch *)emalloc(sizeof(*obj));
 php_COM_set(obj,var_arg->pdispVal,FALSE); // not sure whether the last parameter should be TRUE or FALSE
 handle->value.lval = zend_list_insert(obj, php_COM_get_le_idispatch());
 

Also, the code in php_COM_set is somewhat bizarre:
- the returned value (hr) will not be set if cleanup is FALSE
- pDisp is unnecessarily cleared if cleanup is FALSE (it's a parameter, and it's not used afterwards).

Also, I am not sure that reference counting for COM objects is correct.

Also, please comment your code. It took me a day to find out this little bug.

Sasha