In a moderately complex PCRE regex, some parenthised subexpressions appear in the wrong place in preg_match_all's returned array of matches.  This script reproduces the problem (it could probably be pared down further but is already a lot more simple than the case that originally showed me the error):

<?
preg_match_all("/(.*?)(?:(\\w+)( *@ *(\\w+)?(?=\\W|\$))?|\$)/s", "foo[bar @ baz]", $matches);

print "<pre>";
for($c=0; $c<count($matches[0])-1; $c++) {
  print "MATCH $c:\n";
  print "  0: {$matches[0][$c]}\n";
  print "  1: {$matches[1][$c]}\n";
  print "  2: {$matches[2][$c]}\n";
  print "  3: {$matches[3][$c]}\n";
  print "  4: {$matches[4][$c]}\n\n";
}
print "</pre>\n";
?>

output under 4.0.6 is:

MATCH 0:
  0: foo
  1: 
  2: foo
  3:  @ baz
  4: baz

MATCH 1:
  0: [bar @ baz
  1: [
  2: bar
  3: 
  4: 

MATCH 2:
  0: ]
  1: ]
  2: 
  3: 
  4: 

the following equivalent perl 5.6.0 one-liner produces the expected result:

perl -e '$_="foo[bar @ baz]"; while(/(.*?)(?:(\w+)( *@ *(\w+)?(?=\W|$))?|$)/g) { print "MATCH:\n  &: $&\n  1: $1\n  2: $2\n  3: $3\n  4: $4\n\n"; }'


my copy of php is compiled as an apache module, as follows:

./configure --with-apache=../apache_$APACHE_VERSION --with-gd=/usr/local --with-jpeg-dir=/usr/local --with-png-dir=/usr/local --with-xpm-dir=/usr/X11R6 --with-imap=/usr/local --with-mysql=/usr/local/mysql --with-zlib=/usr/local --enable-sysvshm=yes --enable-sysvsem=yes --with-config-file-path=/usr/local/lib --enable-track-vars --disable-magic-quotes --with-pcre-regex --enable-apc