Description:
------------
When a class is required because of a callback through call_user_func etc. no validation on the class name is performed. This can lead to a problem when the name is specially crafted.

One could expect the code below to be quite safe - it checks for class existence and tests if the class is a subclass of expected base class - but nevertheless it leads to information leak.

The documentation should state that the parameter of __autoload does not neccessarily conform to the grammar of the class name.

Reproduce code:
---------------
<?php
/**
 * This is quite basic autoload function, similar to the one in documentation
 * at http://www.php.net/manual/en/language.oop5.autoload.php
 *
 * There is no mention there that it is possible for dangerous characters to
 * appear in the $class_name so it has to be handled with care.
 */
function __autoload($class_name) {
    echo "Autoloading $class_name\n";
    if (file_exists("classes/$class_name.php")) {
        require_once "classes/$class_name.php";
    } else {
         die("Autoloading $class_name failed\n");
    }

}


// somewhere in main program
$className = "../../../../../../../etc/passwd\0" . 'Controller';

$class = new ReflectionClass($className);

if ($class->isSubclassOf('Controller')) {
    call_user_func(array($className, 'handleRequest'));
}

?>