Running the following piece of code results in a segmentation fault.

<?
$ar = preg_split("/<\/?[^>]+>/", "<a href='test'>a <b>test</b> of this function</a>");
print "$ar[0], $ar[1], $ar[2], $ar[3], $ar[4], $ar[5]\n";
?>

Backtrace:

(gdb) bt
#0  0xff136c5c in strlen () from /usr/lib/libc.so.1
#1  0xff17ec20 in _doprnt () from /usr/lib/libc.so.1
#2  0xff180c18 in vsprintf () from /usr/lib/libc.so.1
#3  0x1383c in php3_printf (
    format=0xa4b60 "<br>\n<b>%s</b>:  %s in <b>%s</b> on line <b>%d</b><br>\n")
    at main.c:329
#4  0x13ad8 in php3_error (type=8, format=0xb74a0 "Undefined index:  %s")
    at main.c:421
#5  0x33e44 in zend_fetch_dimension_address_inner (ht=0x1395a0, op2=0x1410c0, 
    Ts=0xffbeecf8, type=0) at zend_execute.c:459
#6  0x34308 in zend_fetch_dimension_address (result=0x141080, op1=0x146118, 
    op2=0x1410c0, Ts=0xffbeecf8, type=0) at zend_execute.c:602
#7  0x35578 in execute (op_array=0x140130) at zend_execute.c:1086
#8  0x14d00 in php_execute_script (primary_file=0xffbef0f8) at main.c:1121
#9  0x1ab7c in main (argc=3, argv=0xffbef17c) at cgi_main.c:448


I guess it's trying to print a warning, but error_filename ends up being NULL.  This makes it crash, on Solaris at least.