Interesting catch.

The relevant code looks as following:
    for (i = Z_STRLEN_P(arg); i > 0; i--) {
        c = *s++;

        digit = (c >= '0' && c <= '9') ? c - '0'
            : (c >= 'A' && c <= 'Z') ? c - 'A' + 10
            : (c >= 'a' && c <= 'z') ? c - 'a' + 10
            : base;

        if (digit >= base)
            continue;

        switch (mode) {
        case 0: /* Integer */
            onum = num;
            num = num * base + digit;

            fprintf(stderr, "num = %d, onum = %d\n", num, onum);
            if (num > onum)
                break; /* No overflow, continue */

            fnum = onum;
            mode = 1;
            /* fall-through */
        case 1: /* Float */
            fnum = fnum * base + digit;
        }
    }


from ext/standard/math.c ( _php_math_basetozval ).

This code assumed that an overflow also occured when the newer 'num' == 'onum'. "A" fix would be to change the comparison to be ">=" instead of ">" .

But I don't know the code well enough, someone else needs to check this toroughly.

Fixed in CVS. There were also a number of other issues regarding overflow detection which have been addressed now.