Envionment:
 - Windows 2000 server or Windows NT 4.0 SP6
 - Apache 1.3.20 or 1.3.22
 - PHP v4.0.6 (windows binaries from www.php.net) running as CGI

 i'm trying to parse XML file by using expat and insert parts of it into DOM XML tree, i have. But PHP crashes, because of reading memory at address 0x00000000. This bug is 100% reproducible with test case, listed below on 2 different machines.

 Here is test case:

file test.php:
-------------------------------------------------------
<?php
function startElement($parser,$name,$attrs)
{
    global $path,$curPath,$curNode;

    $curPath .= '/'.$name;
    if (preg_match($path,$curPath))
        $curNode = $curNode->new_child($name,null);
};

function endElement($parser,$name)
{
    global $path,$curPath,$curNode;

    $pathName = substr($curPath,strrpos($curPath,'/')+1);
    $curPath = substr($curPath,0,strrpos($curPath,'/'));
    if (($name==$pathName) && ($name==$curNode->name))
        $curNode = $curNode->parent();
};

$path = '|^/root/news(/.+)?$|';
$curPath = '';

$xmlStr = join('',file('file1.xml'));
$xml = xmldoc($xmlStr);
$curNode = $xml->root();
$xmlStr = join('',file('file2.xml'));
$parser = xml_parser_create();
xml_set_element_handler($parser,'startElement','endElement');
xml_parser_set_option($parser,XML_OPTION_CASE_FOLDING,false);
xml_parse($parser,$xmlStr,true);
xml_parser_free($parser);

echo htmlspecialchars($xml->dumpmem());
?>
-------------------------------------------------------

file file1.xml:
-------------------------------------------------------
<?xml version="1.0"?>
<root>
    <node>
        <child id="1"/>
        <child id="2"/>
        <child id="3"/>
    </node>
</root>
-------------------------------------------------------

file file2.xml:
-------------------------------------------------------
<?xml version="1.0"?>
<root>
    <news>
        <item id="1"/>
        <item id="2"/>
        <item id="3"/>
    </news>
    <products>
        <product id="1"/>
        <product id="2"/>
        <product id="3"/>
    </products>
</root>
-------------------------------------------------------

 PHP crashing can be avoided in two cases:
1. By removing lines, related to work with DOM XML:
        $curNode = $curNode->new_child($name,null);
        $curNode = $curNode->parent();

2. By removing regular expression matching:
    if (preg_match($path,$curPath))

 Switching from preg_match() to ereg() give the same crash.