Description:
------------
This is testded with 4.2.1, 4.3.4 and 4.3.6RC2, the script
produces a segfault. 
PHP is compiled with-apxs2 or with apache 1.3 with no
special parameters to ./configure.
The script produces segfaults both on console
php interpretator or when loaded with apache server.

Reproduce code:
---------------
<?php
class AClass {
  function AClass($v) {$this->v = $v;}
  function func() {return $this->v;}
}
function & func($mall) {
  if (is_array($mall))
    return array ("b" => func($mall["b"]));  
  else
    return $mall->func();
}
function random($staatus="OK\n") {
  $a1 = array();
  $a2 = func(array("b" => new AClass($staatus)));
  $a1 = array(array_merge(array(), $a2));
  $important = 0;
  return array_values($a1);
}
$out = random();
echo $out[0]["b"];
?>

Expected result:
----------------
It should print 'OK'

Actual result:
--------------
echo receives a segfault.