<? 
   function &foo(&$str) {
     //$str = str_replace("a", "b", $str);  // line *
     return $str;
   }

   echo $str = &foo($str = "aaaaaaaaa");
?>

   If uncommect line *, we not have 'Segmentation', but have unpredictable behavior.
 
   P.S. I know that it bogus code

(gdb) run -f 1.php
Starting program: php -f ~/public_html/test/1.php
Program received signal SIGSEGV, Segmentation fault.
chunk_free (ar_ptr=0x4060adc0, p=0x82dc080) at malloc.c:3049
3049    malloc.c: No such file or directory.
        in malloc.c
(gdb) bt
#0  chunk_free (ar_ptr=0x4060adc0, p=0x82dc080) at malloc.c:3049
#1  0x40575f9a in __libc_free (mem=0x82dc088) at malloc.c:3023
#2  0x080c800b in _efree (ptr=0x82dc094) at zend_alloc.c:246
#3  0x080c84a1 in shutdown_memory_manager (silent=1, clean_cache=0) at zend_alloc.c:469
#4  0x080772e4 in php_request_shutdown (dummy=0x0) at main.c:742
#5  0x080737ef in main (argc=3, argv=0xbffff9a4) at cgi_main.c:776
#6  0x405349cb in __libc_start_main (main=0x8072ebc <main>, argc=3, argv=0xbffff9a4, init=0x806ffa8 <_init>, 
    fini=0x81b1ff0 <_fini>, rtld_fini=0x4000aea0 <_dl_fini>, stack_end=0xbffff99c) 
at ../sysdeps/generic/libc-start.c:92