Assigning to Andrei who wrote this thing, he can decide if it's worth to fix this.

It appears that the same kind of problem occurs when using the square bracket construct on class attributes. To demonstrate the problem, replace the "problem_function" in the first code sample with the one below.

function problem_function() {
   $this->var[] = 'foo';

   return TRUE;
}

Backtrace:
(gdb) run testcase4.php
Starting program: /usr/local/bin/php testcase4.php

Program received signal SIGSEGV, Segmentation fault.
fetch_overloaded_element (result=0x830e0a0, op1=0x830e0b0, op2=0x830e0c0, Ts=0xbfbfdbe8, type=1, retval=0xbfbfdc20, 
    overloaded_element_type=1) at /usr/ports/www/mod_php4/work/php-4.3.1/Zend/zend_execute.c:701
701             overloaded_element.element = *get_zval_ptr(op2, Ts, &EG(free_op2), type);
(gdb) bt
#0  fetch_overloaded_element (result=0x830e0a0, op1=0x830e0b0, op2=0x830e0c0, Ts=0xbfbfdbe8, type=1, retval=0xbfbfdc20, 
    overloaded_element_type=1) at /usr/ports/www/mod_php4/work/php-4.3.1/Zend/zend_execute.c:701
#1  0x8142a4b in zend_fetch_dimension_address (result=0x830e0a0, op1=0x830e0b0, op2=0x830e0c0, Ts=0xbfbfdbe8, type=1)
    at /usr/ports/www/mod_php4/work/php-4.3.1/Zend/zend_execute.c:724
#2  0x8146f19 in execute (op_array=0x8305924) at /usr/ports/www/mod_php4/work/php-4.3.1/Zend/zend_execute.c:1267
#3  0x814adab in execute (op_array=0x8305024) at /usr/ports/www/mod_php4/work/php-4.3.1/Zend/zend_execute.c:1640
#4  0x81365f8 in zend_execute_scripts (type=8, retval=0x0, file_count=3)
    at /usr/ports/www/mod_php4/work/php-4.3.1/Zend/zend.c:864
#5  0x810aaea in php_execute_script (primary_file=0xbfbff8fc) at /usr/ports/www/mod_php4/work/php-4.3.1/main/main.c:1573
#6  0x81532b6 in main (argc=2, argv=0xbfbff968) at /usr/ports/www/mod_php4/work/php-4.3.1/sapi/cli/php_cli.c:746
#7  0x80637ca in _start ()

The problems is not in ext/overload, it is in the engine. The code for handling ZEND_CASE obtains the value with no problem. However, when zend_switch_free() is executed, it passes an invalid overloaded property reference to the handler.

Foreach is also affected by this problem.
E.G. foreach( $this->array_attr as $something )

I don't know if you need/want it, but here is some test code  you may want to use while debugging this problem. It contains an example of each part of this bug found so far.

<?php

class overload_tests {
   var $array;
   var $someattr;
   var $bucket;

   function overload_tests() {
      $this->array = array();
      $this->someattr = 'foo';
   }

   function append_attr_array() {
      $this->array[] = 'bar';
   }

   function access_attr_array() {
      foreach( $this->array as $elem ) {
         echo "AA: $elem\n";
      }
   }

   function switch_on_attr() {
      switch( $this->someattr ) {
         case 'baz':
            echo "Shouldn't get here\n";
            break;
         default:
            echo "Switched {$this->someattr}\n";
      }
   }

   function __get($name, &$value) {
      if ( isset($this->bucket[$name]) ) {
         $value = $this->bucket[$name];
         return TRUE;
      }
      return FALSE;
   }    

   function __set($name, $value) {
      $this->bucket[$name] = $value;
      return TRUE;
   }

}

overload('overload_tests');

echo "<plaintext>\n";

$obj = new overload_tests();
$obj->append_attr_array();
$obj->access_attr_array();
$obj->switch_on_attr();
$obj->baz = "What's after baz?";

print_r($obj);

?>

I don't expect to see this resolved in PHP 4.  We're doing overloading differently in Zend Engine 2 / PHP 5 - stay tuned...