Tested this with php compiled as cgi.
Everything works ok when after doing transformation
you use xslt_free() in your script.
When you forget to do so php may segfault.

This happens when there were a scheme/sax handler defined
with object reference:
  xslt_set_sax_handlers($xslt, array("characters" => 
array(&$this, "func")));

Now when php shuts down it calls free_processor() which 
after some recursive *_ptr_dtor() and alike calls reaches
again free_processor() with same zval handle. Since 
sablotron processor is already destroyed it eventually 
comes to segfault.

This doesn't happen when ordinary function is used as 
callback handler.

Backtrace:

#0  0x00000000 in ?? ()
#1  0x400d8432 in Situation::generateMessage 
(this=0x81c4bb8, type=MT_WARN, code=W1_HLR_NOT_REGISTERED, 
arg1=@0xbfffee08,
    arg2=@0xbfffedfc, theMessage=@0xbfffed70) at 
situa.cpp:267
#2  0x400d8ae2 in Situation::message (this=0x81c4bb8, 
type=MT_WARN, code=W1_HLR_NOT_REGISTERED, 
arg1=@0xbfffee08, arg2=@0xbfffedfc)
    at situa.cpp:348
#3  0x400cfb63 in Processor::report (this=0x81c4c58, 
S=@0x81c4bb8, type=MT_WARN, code=W1_HLR_NOT_REGISTERED, 
arg1=@0xbfffee08,
    arg2=@0xbfffedfc) at proc.cpp:991
#4  0x400ce583 in Processor::setHandler (this=0x81c4c58, 
S=@0x81c4bb8, type=HLR_MESSAGE, handler=0x0, userData=0x0) 
at proc.cpp:741
#5  0x400d1a8c in SablotUnregHandler 
(processor_=0x81c4c58, type=HLR_MESSAGE, handler=0x0, 
userData=0x0) at sablot.cpp:728
#6  0x0811adc1 in free_processor (rsrc=0x81c0a8c) at 
sablot.c:613
#7  0x080c3a2a in list_entry_destructor (ptr=0x81c0a8c) at 
zend_list.c:177
#8  0x080c128e in zend_hash_del_key_or_index 
(ht=0x818dc44, arKey=0x0, nKeyLength=0, h=1, flag=1) at 
zend_hash.c:512
#9  0x080c378b in _zend_list_delete (id=1) at 
zend_list.c:56
#10 0x080d9581 in _zval_dtor (zvalue=0x81c4574, 
__zend_filename=0x813d01c "zend_execute_API.c", 
__zend_lineno=274)
    at zend_variables.c:64
#11 0x080c66ab in _zval_ptr_dtor (zval_ptr=0x81c0ad8, 
__zend_filename=0x8149313 "zend_variables.c", 
__zend_lineno=189)
    at zend_execute_API.c:274
#12 0x080d98b4 in _zval_ptr_dtor_wrapper 
(zval_ptr=0x81c0ad8) at zend_variables.c:189
#13 0x080c13ba in zend_hash_destroy (ht=0x81c101c) at 
zend_hash.c:541
#14 0x080d9551 in _zval_dtor (zvalue=0x81c4a34, 
__zend_filename=0x813d01c "zend_execute_API.c", 
__zend_lineno=274)
    at zend_variables.c:57
#15 0x080c66ab in _zval_ptr_dtor (zval_ptr=0x81c0b90, 
__zend_filename=0x8149313 "zend_variables.c", 
__zend_lineno=189)
    at zend_execute_API.c:274
#16 0x080d98b4 in _zval_ptr_dtor_wrapper 
(zval_ptr=0x81c0b90) at zend_variables.c:189
#17 0x080c13ba in zend_hash_destroy (ht=0x81c0b24) at 
zend_hash.c:541
#18 0x080d9521 in _zval_dtor (zvalue=0x81c0c5c, 
__zend_filename=0x813d01c "zend_execute_API.c", 
__zend_lineno=274)
    at zend_variables.c:51
#19 0x080c66ab in _zval_ptr_dtor (zval_ptr=0x81c4b9c, 
__zend_filename=0x81672fb "sablot.c", __zend_lineno=633)
    at zend_execute_API.c:274
#20 0x0811b00e in free_processor (rsrc=0x81c0a8c) at 
sablot.c:633
#21 0x080c3a2a in list_entry_destructor (ptr=0x81c0a8c) at 
zend_list.c:177
#22 0x080c3c15 in zend_destroy_rsrc_list (ht=0x818dc44) at 
zend_list.c:248
#23 0x080c64a7 in shutdown_executor () at 
zend_execute_API.c:196
#24 0x080c8e36 in zend_deactivate () at zend.c:600
#25 0x080637cf in php_request_shutdown (dummy=0x0) at 
main.c:736
#26 0x0805f023 in main (argc=2, argv=0xbffffb34) at 
cgi_main.c:785
#27 0x401e965f in __libc_start_main () from /lib/libc.so.6