Given:

<?php

class foo {
    private $message = 'this is a secret';
}

class bar extends foo {
}

$obj = new bar;
print_r($obj);

?>

Yields:

bar Object
(
    [] => this is a secret
)

While the variable in question is "unnamed" and can't be referenced directly (i.e., via $obj->message), its value _is_ available, which certainly seems counter-intuitive to its declaration of privacy.

This seems related to bug #23272, but I think it warrants its own ticket, as I believe it's more severe. (Especially considering the wasted memory allocation.)